Palo Alto Networks, Inc. (PANW) Q1 2013 Earnings Report, Transcript and Summary

Good day, ladies and gentlemen, and welcome to the First Quarter 2013 Palo Alto Networks, Inc. Earnings Conference Call. My name is Chanel, and I will be your operator for today. [Operator Instructions] As a reminder, this conference is being recorded for replay purposes. I would now like to turn the conference over to Ms. Maria Riley, Investor Relations. Please proceed.

Good afternoon, and thank you for joining us on today's conference call to discuss Palo Alto Networks' Fiscal First Quarter 2013 Financial Results. This call is also being broadcast live over the web and can be accessed on the Investors section of the Palo Alto Networks' website at investors.paloaltonetworks.com. With me on today's call are Mark McLaughlin, Palo Alto Networks' Chairman, President and Chief Executive Officer; and Steffan Tomlinson, Chief Financial Officer. After the market closed today, Palo Alto Networks issued a press release announcing the results for fiscal first quarter ended October 31, 2012. If you would like a copy of the release, you can access it online at the company's website, or you can call The Blueshirt Group at (415) 217-7722, and we will e-mail you a copy. We would like to remind you that during the course of this conference call, Palo Alto Networks' management will make forward-looking statements including statements regarding our expectations of our securities spending and our ability to increase our market share; trends in our business and operating results including our operating margin and non-GAAP effective tax rate and our revenue and non-GAAP earnings per share for the second fiscal quarter of 2013 ending January 31, 2012. These forward-looking statements involve a number of risks and uncertainties, some of which are beyond our control, which could cause actual results to differ materially from those anticipated by these statements. These forward-looking statements apply as of today, and you should not rely on them as representing our views in the future. And we undertake no obligation to update these statements after this call. For a more detailed description of these risks and uncertainties, please refer to our annual report on Form 10-K filed with the SEC on October 4, 2012, the final prospectus for our secondary public offering filed with the SEC on October 18, 2012, and our earnings release posted a few minutes ago on our website. Also please note that certain financial measures we use on this call are expressed on a non-GAAP basis and have been adjusted to exclude certain charges. We have provided reconciliations of these non-GAAP financial measures to GAAP financial measures in the Investors section of our website located at investors.paloaltonetworks.com and in our earnings press release. Now I'd like to introduce Mark McLaughlin, Chairman, President and Chief Executive Officer of Palo Alto Networks. Mark?

Thank you, Maria, and thank you, everyone, for joining us today. I'm delighted to be here to share with you our achievements in the fiscal first quarter of 2013. Palo Alto Networks is transforming network security and our clear technology differentiation continues to drive our growth. Customers globally are recognizing the benefits of our solution to solve their pressing network security needs and this is reflected in our growth, which continues to significantly outpace the industry. Today, I would like to outline some of the progress we've made in recent months, which includes a strong first quarter with record revenue, the addition of over 1,000 new customers in the quarter, and hosting our first ever user conference where we further extended our technology lead with multiple product introductions. On the financial side, in the first quarter, we generated record revenue of approximately $86 million, which represents 50% year-over-year growth and approximately 14% sequential growth. We also demonstrated continued growth in operating leverage and delivered non-GAAP EPS of $0.04 per diluted share. On the customer side, we continued to focus on our land, expand and strategy to drive results and fuel our growth. From a land perspective, during the first quarter, we added over 1,000 new end-customers, bringing our current customer count to over 10,000 total end-customers. This is the fourth consecutive quarter in which we added over 1,000 new customers. And on the expand and extend side, our customer lifetime value continues to grow as evidenced by the lifetime value of our top 25 customers increasing to 9.9x their initial purchase, up from 9.5x last quarter. Some examples of wins in the field in the first quarter, we're in a competitive bid against Check Point and Fortinet. We landed a new deal with a major European telecom operator where we're replacing Check Point firewalls and McAfee's IPS for internal IP systems protection, as well as replacing Juniper and TippingPoint for their MSSP business. Additionally, we became the primary firewall for one of the leading European broadcasting companies, replacing Cisco and Juniper in a multimillion dollar transaction. And for this customer, we also provided them with a real-time threat prevention services. We also expanded our relationship with a very large U.S. government agency. At this agency. We won the data center IPS business about 5 quarters ago at 1 location, and this quarter, we extended our presence to all the data centers throughout the United States for IPS and firewalls. We replaced McAfee and beat Sourcefire for distributed security at a global health and beauty company based in the U.S. And finally, on the extend side, one of the leading lifestyle media companies in the world deployed us a data center IPS solution 6 quarters ago. In the fiscal first quarter, we expanded our presence as a customer deployed us as their global data center firewall, replacing Cisco. Also, in November, we hosted our first ever user conference, Ignite, where we had close to 1,000 attendees from over 500 companies and 25 countries. It was exciting and validating to hear repeatedly from our customers that we are helping them to solve their security problems with unmatched solutions. The message from our customers that resonated loud and clear was that our solutions are clearly unique in the marketplace, as no other competitor is able to safely enable applications. At Ignite, we also launched 4 new products, all of which address today's virtualized and physical enterprise networks to further extend our technology lead over the competition. First, we launched 2 new hardware platforms that will address identified opportunities within the enterprise. The PA-3000 Series which is a mid-range next-generation firewall and the M-100, which is an easy-to-deploy, high-performance management appliance for our Panorama management system that introduces distributed log collection capability for large-scale enterprise deployment. This launch represents a significant step forward for our management tools. Also, we introduced our new VM-Series, which is a virtualized next-generation firewall platform that brings next generation network security into the virtualized datacenter environment. We believe virtualized security will become increasingly as important as more core applications are run in virtualized environments, and we intend to be a leader in this emerging space. We've launched the VM-Series in collaboration with VMware to provide our shared customers the ability to address their security and compliance needs while accelerating their adoption of virtualization. We also formally launched WildFire, our subscription-based modern malware protection and prevention service. This new service gives subscribers 1 hour response times for the delivery of modern malware signatures and integrated on-box logging and reporting. To date, WildFire has discovered more than 70,000 new malware files that have not been identified by existing anti-malware solutions, and the enhanced response will ensure that the damages caused by 0-day malware and targeted attacks are mitigated for our customers. WildFire not only detects modern malware but for the first time, enables enterprises to prevent malware. All of our newly unveiled products are supported by the release of PAN-OS 5.0, which has more than 60 new features, focusing on solving unique network security problems in cloud environments, scaling and simplifying network security management in large enterprise environments, enhanced IPv6 capabilities and increase control for managing the growing amount of SSL traffic in the enterprise. Increasingly, we are becoming a partner of choice for other leaders in the technology world. We announced a new multiphase relationship with Citrix that starts with validated joint solutions for their virtual application and desktop virtualization solutions, as well as other -- as well as popular and applied applications. Separately, we added 9 other leading companies to our Technology Partner Program, including RSA, SafeNet, and Skybox Security. Security remains a top priority for CIOs around the globe. In general, we see that security spending is resilient even in a challenging macroeconomic environment. We believe that there will continue to be significant displacements in security spending amongst vendors with the market favoring the next-generation technologies that provide significantly better security and at an increasingly better value. As we look forward, we will continue to be aggressive in maintaining our technology advantage, increasing our market share and ensuring the highest levels of customer satisfaction. With that, I would like to turn the call over to Steffan, for a detailed look at our financial results. Steffan?

Thank you, Mark, and thank you, all, for joining us today. I'd like to mention that unless specifically noted otherwise, we're discussing all numbers, except revenue, on a non-GAAP basis that excludes share based compensation expense and where relevant, its tax-related effects. In Q1 '13, total revenue grew to a record $85.9 million, an increase of 50.5% over a very strong Q1 '12 and 13.6% sequentially. In Q1 '13, product revenue of $55.5 million grew 29.5% year-over-year and 12.3% sequentially, driven by sales of our series of appliances. Services revenue, which is comprised of both subscription and support, of $30.4 million increased 113.4% year-over-year and 16.1% sequentially. Services revenue accounted for 35.4% of total revenue, an increase of 80 basis points sequentially. This is in line with our expectations, and underscores the power of our hybrid revenue model as it provides enhanced visibility. The geographic mix of revenue was 64% Americas; 23% EMEA; and approximately 14% for Asia Pacific, with all tiers posting growth on a year-over-year and sequential basis. Total non-GAAP gross margin in Q1 was 72.6%, in line with our target range. Non-GAAP gross margin decreased 160 basis points year-over-year and increased 70 basis points sequentially. Q1 non-GAAP product gross margin was 74.2%, down 180 basis points year-over-year and 60 basis points sequentially. The sequential decrease is primarily due to product mix. But looking forward, product gross margins will fluctuate as we introduce new products such as the PA-3000 which was introduced in November. New products have a higher initial cost of goods sold, but will improve over time as volumes increase. Our non-GAAP services gross margin was 69.5%, up 60 basis points year-over-year and 290 basis points sequentially. The sequential increase was primarily due to the timing of headcount and project-related expenditures in the quarter. Services gross margin will also fluctuate depending on the timing of the ramp of our service organization. Moving on to operating expenses. We continued to invest in product development and expand our sales in go-to-market organizations. Q1 '13 non-GAAP R&D was $11.6 million, an increase of $1.4 million from the prior quarter, primarily related to spend on programs and headcount additions. As a percentage of revenue, non-GAAP R&D expense was 13.5%, flat with Q4 '12. Q1 '13 non-GAAP sales and marketing expense was $38.3 million, an increase of $2.8 million from the prior quarter. As a percentage of revenue, it was 44.6%, a decrease of 230 basis points sequentially, primarily due to operating leverage. Q1 '13 G&A expense was $7.2 million, an increase of $0.8 million from the prior quarter or 8.4% as a percentage of revenue, flat with Q4 '12. In total, Q1 '13 non-GAAP operating expenses were $57.1 million or 66.5% of revenue, an increase of $5 million or 9.6% from the prior quarter. Moving on to operating margin. In Q1, we saw a strong increase in non-GAAP operating margin, which grew 300 basis points sequentially to 6.1%. The sequential improvement in operating margin this quarter can be attributed to continued natural leverage as we scale, as well as timing of headcount additions. As we've stated previously, our goal is to grow operating margin in a steady manner, but we've also noted there will be near-term fluctuations. Our non-GAAP effective tax rate for the quarter was 42.6%. This rate will continue to fluctuate throughout the fiscal year as it's dependent on our global pretax profit mix and potential discrete events such as the removal of our domestic valuation allowance. Non-GAAP net income for Q1 was approximately $2.9 million or $0.04 per diluted share using 77.8 million shares. This compares to non-GAAP net income of $1.9 million or $0.03 per diluted share in fiscal Q4 '12, and non-GAAP net income of $5.6 million or $0.01 per basic and diluted share in fiscal Q1 '12. On a GAAP basis, net loss was $3.5 million or $0.05 per diluted share -- on a -- basic and a diluted basis for Q1 '13. Turning to the balance sheet. We finished October with cash, cash equivalents and investments of $342.1 million. In Q1, cash flow from operations was $23.1 million, free cash flow was $19.1 million and free cash flow margin was 22.2%. Cash flows benefit from our hybrid revenue model in which we bill for our services at the beginning of the engagement, and we collect the cash shortly thereafter. We ended Q1 with $56.4 million of accounts receivable, up from Q4 '12 balance of $45.6 million. Average days sales outstanding were 53 days, in the middle of our target range of 50 to 55 days, and up modestly from 50 days reported in Q4 '12. Moving down the balance sheet. Our hybrid revenue model helped increase total deferred revenue to $160.4 million, an increase of 86.2% year-over-year and 18.1% sequentially. Short-term deferred revenue of $101.4 million increased 17.5% sequentially. While we're continuing to see an uptick in multi-year deals, the majority of our services engagements are on an annual basis. Let me now turn to our guidance for Q2 2013. We expect revenue growth to accelerate on a year-over-year basis and be in the range of $90 million to $94 million. This equates to a 59% to 66% year-over-year growth. Additionally, we expect non-GAAP EPS to be approximately $0.04 per share using 78 million to 80 million shares on a diluted basis. With that, I'll turn the call over to the operator to open the Q&A session.

[Operator Instructions] And our first question comes from the line of Greg Dunham, Goldman Sachs.

I guess, first question, a common question I get is how often is Palo Alto used as a primary firewall vendor, and you kind of highlighted a couple of wins there and you also noted that the 9.9 statistic from existing customers. But can you address that concern from some investors and how that's progressed over time?

Greg, it's Mark. We said before that we were on the road example that about half of our installations were on the primary firewall, and more than half of our new sales were the primary firewalls. So I think what you're seeing in our results here is -- and plus, the lifetime value statistics we're quoting is that, more and more often, we are the primary firewall, either in the initial sale and specifically, when we're already in an account. That is happening more and more often as well. So that is trending in a positive direction for us where we are becoming the primary firewall and installations were already been put into a company and more of our new sales are primary firewall as well.

Our next question comes from the line of Keith Weiss of Morgan Stanley.

I was just wondering if you could give us a little bit more color into the environment, and in particular, 2 areas. One, the federal government. I know you guys had a really good year last year in federal government, just wanted to see how it turned out this year. And maybe, give us a little visibility into what you guys are thinking about fiscal cliff and whether that's going to impact you guys at all. And then, maybe a little bit on EMEA. It looks like EMEA, you had a nice balance back there -- or a nice balance there in terms of growth, the absolute revenue number from Q4 into Q1. How are you guys feeling about EMEA given the current macro over there?

Let me start with the highest level question on the fiscal cliff, which is, it's really uncertain to say what kind of impact that would be. I think from-- if it was going to be a big impact probably, it would be more in the government space if there was sequestration or things like that. The main impact of that sort of thing, primarily, would be at end of the year for that, which has gone by, so there's quite a bit of time for everybody to get all that stuff worked out. That sort of macro condition aside in the Fed space, for us, that continues to be a very strong vertical force. We expected a strong quarter from the Fed, as usual, in Q1 and it performed to our expectations. All that aside, there's still new vertical accounts of more than 15% of our overall business, and we are still very nicely diversified. And then, from an EMEA perspective, we continue to keep our eye on that like a lot of companies do, particularly, in Southern Europe but that region, for us, had very strong year-over-year performance. And also we had good strong -- sequential growth in EMEA this quarter as well.

And our next question comes from the line of Phil Winslow of Credit Suisse.

You had a particularly strong number in deferred revenue this quarter, I wonder if you could just comment on the trends that you're seeing in terms of just attach rates of the various subscriptions and then, renewal rates. And I just have one follow-up to that.

Sure. So deferred revenue grew very nicely, it grew faster than our revenues on booked quarter-over-quarter and year-over-year basis. When you think about the profile of the deferred revenue, it's split between subscriptions and maintenance. The attach rates have basically held steady to directionally improved a little bit. We have -- in the subscription bucket, URL filtering, threat prevention, GlobalProtect. And now we've just started to monetize WildFire, that wasn't in these latest results, but that will be a benefit for us going forward. The attach rates haven't really changed that much since we talked last time, although, we typically get, call it, 1 to 2 subscriptions at the time of the initial sale. But as part of our land, expand and extend strategy, we are getting more subscriptions that are being sold into accounts after we win them. On the maintenance front, the attach rates remain very high and in the renewals, for both maintenance and subscriptions, are also very high.

Got it. And then, just one quick follow up on just pricing, I mean, one of the concerns that investors have is there's a sort of price war going on in the perimeter security market, just curious what you're seeing in terms of pricing, this quarter versus the last, and sort of, year-over-year. And any commentary around that will be great.

Yes, Phil. We do see competition on getting aggressive on pricing. We've seen that for quite some time. There's been not a lot of impact to us on that because of a number of things. The first, and most importantly, is that customers see the difference. So it doesn't matter how cheaply you want to sell your technology if it doesn't actually solve the problem they’re trying to solve which, in this case is, "Can I safely enable an application?" And since we are the only guys in the market to have that technology, people continue to buy. They continue to pay premium price for that. I think it's reflected, as well, as our margins are very good, they continue to hold steady. So we do see pricing pressure out there, but I don't see that being a successful tactic against us.

Our next question comes from the line of Joel Fishbein, Lazard.

It looks like your spending on sales and marketing almost doubled year-over-year, can you just talk about ways in which you're focused on increasing distribution and maybe going after different vertical markets there? That would be helpful.

Sales and marketing is definitely an area where we're going to continue to make meaningful investments. And what's been happening over the last year is, we have, again, a high-touch indirect fulfillment model where we have quota carrying salespeople and we are basically selling everything we can get in front of. We're balancing that with a robust channel strategy where we have a 2-tier distribution system. So we've been selectively adding high-quality partners to help extend our feet on the street without incurring too much cost that, now you can see, on a sequential basis, actually, sales and marketing as a percentage of revenue showed some nice leverage coming down, call it, about 200 basis points. And that's something where -- our target model is 30% to 33% for sales and marketing. And we feel like with the combination of our high-touch folks with a robust channel strategy and the additional partnerships that we've announced, with Citrix and VMware, et cetera, we should be getting more leverage out of sales and marketing going forward.

Our next question comes from Jayson Noland, Robert Baird.

Getting a lot of questions on software-defined networking, and we saw the big switch networks announcement, I guess, how important is SDN to you and then, how are you positioned?

Yes. So I think that SDN is a trend that a lot of folks are talking about now. And from our perspective, it's a good thing if it actually takes hold. Just because it makes the -- what we're selling even more unique and relevant makes proprietary hardware guys less relevant. But I'll let -- Nir's with the tier 2, I'll let him dive in on that for just a second.

Yes. If you look at SDN, SDN is really looking at solving 1 big problem, which is very frequent changes in virtual data centers, where things move around. And when virtual machines move around or when they're added or removed from the infrastructure, security and networking has to follow them. And that's really what SDN is trying to solve. If you dig into the announcements that we've made around virtualization a few weeks ago at Ignite, as part of PAN-OS version 5.0, you will see that there is -- not just that we announced a virtual firewall the VM-Series, but we also announced functionality that can track the movement of virtual machines in data centers, track their addition, their removal, their movement from 1 place to another. And by that, by integrating that into your VM infrastructure, into your orchestration tools, we are able to effectively perform what SDN performs, which is, track changes in their data center and adjust to them in realtime without needing to change any configuration manually. I think part of our work with VMware is also around that.

Our next question comes from the line of Michael Turits, Raymond James.

Two questions. One, was there any change in the mix of the amount of license that isn't deferred? I don't know if that had any impact on product or licenses, because that was a little -- a little bit slower than the rest of the business.

Yes. There was really no change in mix in deferred revenue. As we said previously, the vast majority is services and deferred revenue, so there was not any mixed change.

And then, did you -- what did you add in terms of headcount? How many -- what was the net add in terms of the headcount this quarter, and what do you expect that to be like over the next couple of quarters?

Yes. So we ended at 847 total headcount in Q1 '13 and that was off of a Q4 '12 number of 755. And what we stated previously was, we anticipate adding approximately 75 to 100 heads per quarter. The prior quarter, we came in at the lower end of that range. This quarter, we came in near the high end of that range. There's going to be some fluctuations as we go forward. But we are heavily investing in the business by doing it in a profitable manner.

And if I could squeeze one more in. What about your expectations around CapEx? I know that you planned some it accelerations there, what's the schedule for that?

The CapEx this quarter was approximately $4 million. And for the rest of the year, it will be in the, call it, low- to mid-single digits. We're not providing specific guidance on a quarterly basis, but we expect to be in the low to mid-single-digit in terms of CapEx.

Our next question comes from Tal Liani, Bank of America Merrill Lynch.

Hello. My question is about the gross margin and breakdown between services and products. So if I compare your gross margin to some of your competitors, your margins are lower. But earlier in their lifecycle, they also had similar gross margins, if I compare it to Fortinet, for example. And later on in life, they had a massive boost in gross margin to the 80s and high-80s. So the question is, is there something different in your business model that is going to result in lower potential upside to gross margin? Is gross margin, mostly the services side, is it the function of volume? How do we compare between you and other companies in the space on this number?

Well, let's start with our target model, which is 70% to 73%, we've been operating within that range. When you make a comparison between Palo Alto Networks and some of the other folks out there, whether or not it's Fortinet or Check Point or Cisco, on the security business, every company is slightly different. What we've said to folks over time is, once we get to our target model, which is -- when we talk about target model, we also look at operating margin, which is 22% to 25%, we will reevaluate where we are in gross margin. So this isn't a long-term target. This is a -- it's a target model that will be reassessed. Structurally, a tailwind for gross margin will be increasing subscription sales, and as a positive potential tailwind down the road is, we just introduced the paid-for version of WildFire, which will be additive and it's very high gross margins for us. The maintenance part of our services revenue is very much in line with other companies of similar size and scale. But unlike other companies that we compete with, we are adding over 1,000 customers per quarter. We're growing -- if you look at the Check Points, the Ciscos and the Fortinets, on a -- if you just compare numbers on a sequential basis, we're growing 10x to 12x faster against some of those folks there. So we're making investments in the maintenance organization to ensure that we have the best customer service that's out there. So to net it off, we think that long-term, there could be some upside to the gross margin target, but we want to get to our target model first, then we'll reassess.

Our next question comes from Jeff Kvaal, Barclays.

I have 2 questions. Mark, maybe this is one for you and Nir, and that is, could you help us understand the ADC vendors rolling all of this, I think many of them have started to talk a lot more aggressively about security in the past several quarters. And then, Steffan, one for you as well. Is there a seasonality element to the deferred revenue and with -- affiliated with your fiscal year end, should we expect a different pattern in the upcoming quarter?

Jeff, I'll take the first one, at ADC side. I think specifically, you're probably talking about F5 that talks more and more of security as a growth opportunity for them. When they are doing that, they're talking about a different space than we are in, from a security perspective. So they are sitting in a different part of a network for different purposes and from a network security perspective they're primarily consistently talking about safe installation of firewalls at different points in the data center market we do not play in today. So with...

I could give some more details around that. If you look at where customers deploy security, there are several places. Firstly, of course, the perimeter. The Internet-facing -- what's called Internet-facing firewall and really, the requirements there are next-generation firewall, meaning safely enabling the applications, scanning traffic for viruses, for spyware for all kinds of malware, for exploits, for data leakage, and so on. And of course, we don't F5 playing in that market at all. This -- we don't offer inspection as a viable solution in that market at all. The secondary area where security is deployed is in the data center and even there, there are 2 use cases. The first use case is the external data center, the Internet-facing data center where you run your web servers. And the requirements there, in many cases, from security perspective are pretty minimal, meaning, allow only traffic to the web servers, meaning ports 80 and 443 and then, blocking all the rest of the traffic. That, of course, can be achieved using a simple system inspection firewall and I think that's what the ADC vendors, such as F5, are doing. They call it an outbound firewall. The third area where you see security being deployed, which is still in data center, is in the corporate data center. In the corporate data center, the requirements are, again, for next-generation firewalls because customers want to control access to applications, control who can access which application, perform which functions in these applications, and also scan the data for bad things and for good things moving around. That's, again, something that we don't see the ADC vendors playing in and we're not sure whether they have the path of getting there without significant investments in anti-malware technology, in IDS technology, data leakage technology, as well as next-generation firewall technology. In terms of market size, we think that the external firewall, excuse me, external Internet-facing data center firewall is a much smaller market than the corporate data center and the Internet-facing firewall, the perimeter firewall. And these are the areas we focus at. We believe the ADC market -- the ADC vendors are focusing on the small part of the market, which is the Internet-facing security or Internet-facing firewall.

And Jeff, on the second question, is there a seasonality element to deferred revenues. I would say that it's a little-- it's still too soon to call seasonality trends, although, we are seeing a little bit of natural fiscal year seasonality with Q4. We were happy that -- and pleased with our sequential growth on a revenue basis and on the deferred revs. With our guidance, we're obviously guiding up, sequentially, and you would expect that there would be also an increase in deferred revs. We are not going to get into the specifics around what the rate of growth in deferred revenues is forecasted to be, but we anticipate that, that balance should grow.

Our next question comes from Walter Pritchard, Citigroup.

Mark, I'm wondering if you could talk about, you had -- I think, Mark Anderson, the new head of sales on board here for now a full quarter, I'm wondering if you could talk about what changes have been made or you foresee making under his leadership in running sales?

Yes, Walter. Mark's doing a fantastic job, not surprising for us given all the demonstrated success he's had at F5 in building a business, growing at these kinds of rates, over time, at scale. A number of things that we're doing that probably are relevant, the first is, is that we are very, very focused on large accounts. So the company's always been successful into selling in, I'll call the Global 2000, and you can see from our LTV numbers that we continue to add business in all of the accounts, particularly, in new large accounts as well. Ken has just really haven't been super organized about that, and Mark's done a lot of work on bringing a lot of organization and focus into large accounts so we can keep the LTV growing there, as well as across the entire customer base. In addition to that, making sure that we are doing as good a job as we can with the channel in a coordinated fashion, we didn't really have an owner for, across the company, from a channel perspective before. Mark has really taken the reins on that as well, and put some new hires in the organization working with the channel folks. And then, the third is just a lot of operational discipline that he's brought to the system as well from certainty of numbers, commit, culture, those kinds of things, which are very important, obviously, when you're running a publicly-traded company. So all very, very positive things going on here.

And then, I'm not sure if for Mark or for Steffan, but you mentioned the LTV number and the 9.9 versus the 9.5. Can you talk about how much of that you're seeing come in from luring an annuity and WildFire being the most recent versus just simply going in and more fully penetrating a customer that starts out with you guys in one part of the network?

It's a mix in a good way, good blend. So in the cases where the customers are doing repeat purchases, and these are pretty much across the board with all the customers doing these repeat purchases. We find 2 things that happen and they are a good blend of their buying more devices as they continue to spread it out to the network and they continue to buy more services to put on those devices. I think an interesting there, Walter, is what's penetration, even at some of our largest customers. And our conversations has been, looks at their networks, how large the networks are, boxes that have been deployed over time. We think that's still -- given some of our largest customers are relatively small, just penetration, because these guys measure devices in hundreds, and sometimes thousands of devices in some of these biggest networks.

Our next question comes from Gregg Moskowitz, Cowen and Company.

Mark, I know we're only about 3 weeks removed from the Ignite user conference, but just wondering even anecdotal... [Technical Difficulty]

Everybody, this is Mark. I understand there's some issues where folks can hear us but we can't hear anything on the line.

I'm back on the line sir, it looks, I do apologize all our lines have just dropped. So we can just proceed with our next question it will be just be one moment. Our next question comes from the line of Gregg Moskowitz, Cowen.

Second time is a charm. So Mark, I know we're only about 3 weeks removed from the Ignite user conference, but just wondering, even anecdotally, with the early interest has been like, thus far, for your PA-3000 appliances?

It's good, Gregg. So if I could just it at a higher level, and I'll talk 3000 specifically for a second, but the user conference, Gregg, we had -- it's our very first one. We had almost 1,000 folks there and I thought it was every interesting that almost all of them paid to attend, which is unusual in these tough times. But great, great feedback from folks across the board about things we've done and very excited about the things that we launched. So we put a lot of stuff in the market here recently and spent a lot of time with the customers explaining it. The 3000, in particular, is a device that was clearly being asked for from the market. There's a clear market need for that, for a midrange device. And we've been selling it ever the since the day we announced it.

Okay, great. And then, just a quick follow-up for Steffan. The tax rate, as you noted, was higher this quarter and I understand there are going to be fluctuations going forward. I just wanted to get a sense, for fiscal '13, are you still expecting the tax rate to be 34 to 39?

Right now I think it's going to be at the higher end of that range. After we get through this fiscal quarter, Q2, we'll give a little bit more guidance on the back half -- for the back half of the year on the next call.

[Operator Instructions] Our next question comes from Brent Thill, from UBS.

And just as it relates to some of the value-added subscriptions that you can cross-sell to clients, can you just give us -- like bring us up to speed on where you're at, maybe you can talk a little bit about the economic model in terms of what you're seeing from customers?

Sure, if you mean subscriptions services, so now with the paid version of WildFire now in the market, we have 4 subscription services. We have threat prevention; we have the URL Web filtering, we have our GlobalProject, and now the paid-for version of our WildFire. The economics are similar for the subscription services, so it's 20% of the list price of the device per subscription service. So there's been no change to that since the last time we talked.

Okay, great. And maybe for Nir, just as it relates to everyone talking about a APT and they're looking at, potentially, incrementally-priced products to go after this. Are you thinking of this as an incrementally-priced piece, or is this embedded in the platform?

So the way -- so our APT or modern malware service called WildFire is made of 2 pieces. The first piece is the collection service where we collect -- we let our customers run their traffic through a separate -- through a cloud-based service which we don't charge for. And we scan their traffic and we look for malware in it. And if we find malware, we take that malware and we generate, immediately, signatures to go and block that malware and similar malware trying to get on the customer network, as well as to block existing instances of that malware that are already on the customer network trying to communicate back with the bad guys. The receiving DOS signature is a paid-for service. So sending us traffic for examination is a free service, and this is really what our competitors are selling, meaning, if you look at the standalone APT vendors, what they are selling is a detection service, they don't have a prevention -- they don't have prevention capabilities, mostly, for the fact that they don't have a high-speed firewall IPS and anti-malware device sitting in the network. They don't provide that, and nobody is looking at them to provide that. So we decided to give that part to the customers for free, because we also see value from collecting those samples. The second part that we do which is unique to Palo Alto Networks, no one else in the market can do that, is to turn those signatures around -- is to turn those malware around into signatures that, as I said, are designed to block both the malware trying to get into the network, as well as existing instances of the malware trying to get out of the network. This is unique to Palo Alto, and this is what we charge for as part of the new WildFire subscription service.

[Operator Instructions] Our next question comes from the line of Frederick Grieb from Nomura.

Two for me. First, some public software companies disclose how changes in billing terms may have impacted year-over-year billings growth in the quarter, could you give us a similar commentary? And the second question is just on the competitive environment. You're clearly taking share, but when you compete against Check Point, Cisco, Juniper, who do you have the best win rate against, and why?

On the first one, we have a hybrid revenue model, and one element of that revenue model is SaaS-based. We are -- the crown jewels of the company are in software but we are an appliance-based vendor that has a portion of the revenue stream being SaaS. So with that as the backdrop, there's no changes in billing terms for our services, our subscriptions or maintenance. So there is no impact on a quarter-over-quarter basis relative to billings. Now I will say that billings is not something that we focus on because we are primarily a book-and-ship business. With that said, billings was $110 million in the quarter, and it grew faster than revenue.

And Frederick, on your competition question, those are the 3 firewall vendors you see in the market, you mentioned Cisco, Juniper and Check Point. And we have been taking share from all 3 of those vendors. As far as which one we see more often, thus, Cisco has the largest market share so we tend to see them in more instances. You remember, most of the sales we do are displacement sales so they are in more accounts already to start with, and we tend to see them more often as far as we're displacing. But generally, it's just all market share where folks are already installed.

I guess, I was wondering more -- I guess, win rate, do you beat Cisco 60% of the time, Check Point, 70% of the time? Did you have a statistic like that?

Yes. I think the better way to look at that is -- the way we look at it is, when we get into an account, like we said earlier, if we can get the technical valuations done, our win rates are very high, and that is across-the-board against any competitor. It doesn't matter who it is.

Our next question comes from Jonathan Ho, William Blair.

Just one question around the competitive environment. Are you seeing any competitive response or any shift there in terms of--and, maybe, a reaction from some of the incumbents that are losing significant share either on the pricing front or on the product side?

; Jonathan, as I said a little -- I'll take those in reverse. On the pricing, we've seen some more aggressive pricing in the market, which is a natural response if you don't have the technology that the customer's after, which is, the more important piece, we haven't seen any competitive response to what we're doing as far as safely enabling application. So interestingly as well, we pay attention to that question a lot. We think we're very far ahead of the competition already, we think we've widened that gap with the 5 products we put in the market in the last few weeks. And when we asked our close to 1,000 customer that came to our user conference, what they thought about that, just resoundingly, they were very clear that we're unique in the market.

Got it. And can you guys talk a little bit about channel, incentives and training, and maybe some of the results of the investments that you guys have made on that side and, potentially, what the impact could be, sort of, going forward?

Yes. So on the channel side, we have a bit of different model than other folks, so we're a quality versus quantity shop, about 850 channel partners today that we-- from that, that will continue to grow over time at a pace we like. The reason -- I mean of pace we like is, it's very important when you have the disruptive technology in the market -- you're almost always displacing an existing provider, that you are adequately trained to represent the technology in order to get the sale done. So we're very careful with who we bring on from a channel perspective. And then, we spend quite a bit of time with them, it does cost money and resources to get them educated, and trained, and tested and certified, but the results are -- speak for themselves. When they go through all that with us, they do very well. We had our North American partner conference right after our user conference, actually, and it's very interesting, with over 200 of our partners there, has asked a quick question of how many folks had more than doubled their business with Palo Alto Networks in the last year, from the last conference, and we had multiple dozens of people stand up in the room and everybody else in the room said, yes, I'd like to do that, too. So that continues on the interest side. Also at the user conference, we trained a couple of hundred -- we certified a couple hundred of our partners and users through testing, which is important as well, to make sure they understand the products. I think that's all working really well for us and at a pace that we like.

Our next question comes from Catharine Trebnick, Northland Securities.

Could you provide us -- at the beginning of the call you said that you were up significantly 14% quarter-over-quarter, but could you delve into some of the vertical segments that are possibly driving some of this? And if those are driven by any of compliance or regulatory in nature?

Catharine.,, So if we look -- if we break down our entire business from a vertical perspective, it's very nicely distributed, not only vertically, but geographically as well. It's very nicely distributed, so we don't have an overwhelming concentration in any vertical, which we think is a good degree of lower risk in the business. No vertical accounts were more than 15% of our business today and the ones that tend to be higher, as close to the 15% are financial services, the public-sector space and the high-technology space. Not surprisingly, since they have a lot of assets online to protect.

How about health care? I'm kind of curious on that since there's a lot of move to digitization of all the patient records. It seems like that might be an emerging opportunity.

That's very -- that's a fair impression. So I think health care is probably number 4 or 5, I listed the first 3, but you picked up on the -- it was either the next one or the one right after that. But, yes, I think what you're getting at is, is that in a number of industries, they have different compliance requirements, regulatory requirements than other industries. And if that's the world you live in, then you're likely to be very interested in our technology, and health care is clearly one of those.

Ladies and gentlemen, that concludes the present -- I'm sorry, that concludes the Q&A session. And I now like to turn the call over to Mr. Mark McLaughlin for closing remarks.

Thanks, again, everybody, for being on the call today. Sorry for some of the technical difficulties there. I'd like to reiterate my appreciation for the hard work of the Palo Alto Networks team in support of all our customers and partners as we continue to revolutionize the enterprise network security space. We look forward to speaking with you again next quarter. Thank you.

Ladies and gentlemen, that concludes the presentation. Thank you for your participation. You may now disconnect. Have a great day.