Holistically, company application. And then Nathan Jenniges as well, from BlackBerry's cybersecurity background. As a security analyst, gonna spend some time talking about security, but we do have the broader BlackBerry company to talk about. So, I'll let you talk about that as well, but we'll spend some time talking about security and cool things I'm interested in that side. So, without any more blabbing from me, I'll let you guys introduce yourselves and, Tim, give a little bit of background, Nathan, otherwise.
Yeah, sure. Well, firstly, thank you, Eric, and all the team for having us here. It's great to be here in beautiful Colorado. So my name's Tim Foote, for those of you who don't know me. Up until fairly recently, I was the head of investor relations, then moved in to be CFO of the cybersecurity division, and then last week became the CFO of the company. So very proud to be in this role. Looking forward to getting stuck in and moving the ball down the field somewhat, and we'll get into that in more detail. Nate?
I'm Nathan Jenniges. I'm the Senior VP and General Manager of our cybersecurity products. I joined BlackBerry 2.5 years ago in a strategy product management role, and then last September was asked to take over all of the product engineering organization. Before this, I worked at McAfee, and I also worked at Motorola, so I know the history of RIM and BlackBerry as well.
Yeah.
All right. So just to level set for everyone, again, BlackBerry is a big company, at least two big silos or two big divisions. So talk about the divisions of BlackBerry, what your side has.
Yeah. Okay. So we like you say, two divisions. So the first one's called IoT, Internet of Things, and the largest component by far in there is our QNX business. And QNX is the leader in foundational software, particularly on the safety certified side in automotive. But not just automotive, it's in some adjacent industries as well, like rail, medical, industrial.
Effectively, the key differentiator, and gives it quite a defensive moat in its competitive space, is the fact that it's at the intersection of safety certification, which is actually a really hard thing to do, and also high performance. So, it's really very few people who can do both, and we're leading it on that side of things.
So there's a fair chance that everyone in this room has BlackBerry software in their car, believe it or not, powering things like ADAS functionality, digital cockpit. So we're very excited about that side of the business. It's in a really good spot. It's got a lot of secular tailwinds that are propelling that business forward over the next few years. So that's, that's in a really healthy state.
On the other side, we got a cybersecurity business, which is really under the hood, and Nate can speak to this much better than I can, but under the hood, we've got four key products in there. So the one that you're more familiar with, Eric, is Cylance on the endpoint security side, but we also have a large, endpoint management product as well, a UEM.
Then we also have a product in the critical events management space called AtHoc, and then some NSA-level cryptographic voice product called Secusmart. So, there's a lot going on. We'll get more into some of the financials, but effectively, the company in the last six months has come a long way. We're going down a path of separating those two divisions. So, as you can imagine, different customer base, different sales cycle. It's just fundamentally quite different businesses.
So, we're far down the path of that, and whilst we're doing it, we're getting our cost structure right. So, got to see that show up, that progress, show up in the stock price, which is one of my key objectives. But right now, that's where we're at.
So one week into the seat, what are the, what... I don't know, what's the seven-day look back or what, what happened? What's the marching plan on the road?
The good news is I've been with the business for quite some time.
Yeah.
So none of this is net new to me. But shareholder value is something that we, that people throw around quite a lot, but this is my priority number one. So, as I mentioned, since we've had the new CEO six months ago, we've taken a lot of costs out of this business. So, it's a top line, around about $600 million business. We've taken out around about $125 million in the space of six months. So significant achievement to do that. And at the same time, paradoxically, some of the fundamentals of the business are actually improving. And that's really a function of the fact that we've been forced to focus in...
Mm
On areas where we particularly win, and it's showing up in things like ARR, which is, has been churning for some time. Last two quarters, sequentially increasing. Dollar-based net retention is similar trend.
Yeah.
I wanna get the business to cash flow positive, as does the CEO, John Giamatteo, as quickly as we possibly can.
Mm.
That means there's more focus has to come on getting the cost structure right, but we're gonna be very kind of forensic and make sure it doesn't damage the fundamentals of the business.
So I wanna narrow in on that security side. That's maybe you're involved with. So talk about that evolution of BlackBerry and their involvement in security. I mean, I think a lot of security investors know back in the three Cs were names and endpoint and Cylance, Carbon Black, and CrowdStrike. So each three took different paths. But so talk about the history of BlackBerry.
... how things have changed since you guys bought Cylance on, et cetera. We'll start there on the history and then we'll take it.
Yeah, I think from a history perspective, I was actually at a competitor to the three Cs at the time, so, I was quite pleased when I saw them get acquired at that time. I think at the time in the market, you know, Cylance had the best AI and ML. We still do. We feel, we've put a lot more investment into that, especially in the last six to 12 months, and, evolving some of what we do with AI. But we were behind on EDR, right? And we're constantly trying to catch up on that, and while we were doing that, other things started evolving around the endpoint, that we weren't playing in.
But what we've seen within our customer base and what we've pivoted to this year strategically is, you know, what were we being asked for the most? What were we seeing customers doing the most? It was adding on MDR...
Yeah
... and MDR services. So we've pivoted heavily on the Cylance side of the portfolio to focus on MDR. We've launched a lot of new products this year.
Mm.
We launched an MDR on-demand service for all of our existing Cylance customers to quickly add on an assisted support capability, and we've just launched an MDR Pro that does the full XDR capabilities as well.
Yeah. Yeah. And then just maybe help roughly scale the different businesses in security, the MDM part, the Cylance part, the critical event management. Just roughly.
You're looking at me.
Yeah. Yeah.
Yeah, so we haven't given that.
Degrees, which one, which one's bigger?
Yeah.
Equal contributors.
So, the two largest...
Yeah
... are the UEM and Cylance.
Yeah.
The other two kind of make up the balance.
Yeah.
But we're very excited about the SecuSUITE because it is, has the potential to grow quite strong.
Yeah. And Nathan, I think since you're joining, you helped narrow the focus on the security side of things. So maybe talk about some of the efforts you've done to narrow the focus. And cost takeout seemed like a big thing...
Yeah
... that was an issue for the company in general. So, as you narrow the focus, what were some of the things that you were able to save cost on? I'm just...
Yeah, a lot of,
Just have to be more pointed in, like, the...
Yeah
... the products you're delivering to focus on that side.
Yeah. Yeah. A big part of the cost structure for us was a startup doesn't necessarily build things efficiently...
Mm
...in the cloud. So, a lot of things were sort of half-built and cobbled together. When I joined, we were trying to build our own data platform and our own XDR platform.
Mm.
That's one of the ones where we scaled it back, and we partnered with Databricks as a leading data platform. We rebuilt the entire Cylance back-end data ecosystem and AI...
Mm
... around a Databricks model. That offloaded a lot of cost of complexity on AWS that we were building.
Yeah
... and a lot of engineers that had to go build stuff that we weren't experts in.
Mm-hmm.
I wanted to focus our R&D resources on what we're really good at, which is the data science and the AI.
Yeah.
So a lot went in there. Plus, we were working on, you know, trying to branch into other areas. You know, we were working on... At one point, we were working on a DLP product. So we shut down a lot of the things that worked, where we weren't at a place to get to the scale we needed.
Yeah. Yeah. And then on the MDR side, I mean, it seems it's, it's incredibly complementary, and it just seems that's where the world is going, just the ability of customers can't handle endpoint themselves, can't handle security in general themselves, and are looking for third-party help. So, so talk to me about kind of maybe how you've—when you added MDR, what you're seeing from customers looking to adopt that product, and, and what, what just gets you excited? And we can kind of... Next, my follow-up will be about the XDR side of things, but yeah.
Yeah. I really enjoy the MDR space. That's another one that we transformed when I joined. It was completely outsourced...
Mm-hmm
... to a third party. We brought that whole business in.
Mm.
We've scaled our own analysts, right? You get...
Mm.
It's something that takes a bit to get scale...
Yeah
... in a business like that. And we've got a... It's still small, but it's the place that's growing...
Right
... in the portfolio. I like it the most because we're really engaged with those customers.
Mm.
We're involved with them every single day, unlike some of the endpoint transactions, where it's like they buy it, you walk away for a year...
Yeah
... and you come back.
Right.
and so we see a lot higher retention...
Automatically
... rate on a per-customer basis as well.
Yeah. Then is it, is your view that first party kinda MDR is the way that people wanna adopt MDR services? I mean, 'cause there's a lot of third-party MDR...
Yeah
... providers out there.
Yeah. We're seeing increasing desire for that just because if you are the first party, you actually understand the technology that's deployed...
Yeah
... way in more depth. And one of the things that we pride ourselves on with each of our MDR customers is, we onboard them. We put a lot of time and diligence into understanding their business and getting the configuration set up in a way that we know is gonna be effective for them.
Yeah. And Tim, financially, what does this mean for you? Is it a significant uplift for customers to add that value-added managed service on top of this?
Oh, absolutely. And, I mean, if we're looking at dollar-based net retention, and fundamentally, this is a ratable business...
Right
... so we need to build the steady, steady base of ARR. The uplift from just pure endpoint software to managed service, full 24/7 managed service, that's a significant uplift.
Mm-hmm.
Even bigger if you look at XDR. We do actually have a really innovative product on, which kind of bridges the gap. It's our on-demand product, Eric...
Yeah
... which, if you can't afford to make that big step to full 24x7, you can actually just press a button and get access to our team...
Mm
... to support you with an issue as and when it comes up.
Mm.
That is a smaller uplift, and we're hoping that that encourages...
... some of these customers to actually realize just how valuable that is...
Yeah.
And then take the full step. So yeah, in terms of upsell, that is probably our key push, certainly on Cylance.
We launched that at the end of May, and it's like 15% uplift on their endpoint license.
Yeah.
So it's a really easy step up, and we've seen a really good pipeline over the last couple of months. We've already converted, you know, several dozen customers and had people already clicking the button, and we helped them. Right.
Yeah.
And then XDR takes it a step further, right?
Yeah.
MDR is endpoint, XDR is more comprehensive than that. So talk about, like, what the value is you're delivering on the managed XDR, and I think you're going pro, pro SKU.
Yeah.
Yeah.
Yeah. On MDR Pro, which we just launched last month, that expands our stuff. Our current MDR offerings required Cylance technology...
Mm-hmm.
to be on the endpoints.
Mm-hmm.
MDR Pro actually opens us up. We've got connectors for all of the major endpoint players, plus all of your network and identity. It's 300+ things that we can then bring in.
Mm-hmm.
It's gonna unlock a different set of opportunities for us 'cause now we don't have to just go to the current customer base, right?
Yeah.
Or, we don't have to go to a customer and say, "Hey, before you can get our MDR service, you got to rip and replace your entire endpoint.
Yeah.
And so, like, hopefully, that'll give us an entry point into a lot of customer accounts.
Yeah. And this is, like, we saw other endpoint vendors buy log management companies. So, this is the idea, you're ingesting logs from all the other sources of telemetry...
Yeah
... dumping into, like, a data lake or lakehouse.
The Databricks's data lakehouse.
Yeah.
Yes.
Yeah. And then, does this allow? So, I think you kinda alluded to it, but it allows you to manage endpoints that aren't Cylance endpoints.
Correct.
Is that right?
Correct.
Yeah. So, do you have partnerships at this point, or, like, strategic vendors you're aligning to, like Microsoft or CrowdStrike or...
Um, no...
[Inaudible]
... I think, just looking out at the market...
Yeah
... there are a lot of Microsoft and CrowdStrike endpoints. That is a big opportunity out there for us.
Yeah. And anything you'd like to highlight on the other side of the security portfolio in terms of where you're focused, unified endpoint management, critical?
Yeah, I'm really excited about a lot of the opportunities across the portfolio as well. And the unified endpoint management, it's been a long time product for us. There is still a sizable customer base. It's a profitable business for us.
Mm-hmm.
And we're still seeing a lot of opportunity around the world, especially in Eastern Europe, Middle East, Southeast Asia, where countries never really deployed these types of mobile security solutions, had nothing. You'll be surprised how many governments, the top officials use WhatsApp, and our ability to bring in both our unified endpoint management to lock down the devices, to make sure their apps and data stay secure. But then we can bring in our SecuSUITE.
Mm.
Right? NSA-level encryption that's used by some of the top governments, and militaries around the world, and bring that into the suite. And then, on our AtHoc product, we continue to find just tremendous opportunities. We've had a stronghold in U.S. government. 90% of the U.S. government uses AtHoc. It was actually heavily used during the CrowdStrike incident by our customers...
Yeah
... because a lot of the systems to communicate were down.
Mm.
Right? And then, whether it's an IT issue like that or a cyberattack, if you can't get to your teams or your email...
Mm
... and communicate, you need a quick and fast way to communicate. So, heavily used in that, heavily used in other recent, public events as well.
Yeah.
We're finding a lot of opportunities to bring that into police and ambulance and some other adjacent sectors from where our strong points are.
You mentioned CrowdStrike on the, on the outage. Do you have a technological opinion on this matter in terms of, like, what went wrong and maybe how you think about, like, the way they did deployments or the kernel access? Do you have a view? Do you do things differently, similarly? Do you think it was a wrong approach, the correct approach, just a mishap on a QA issue?
I, having been in the industry for a while, I think a lot of products are... We're deep. We're deep in the kernel, right?
Yeah.
Of all types of software, we're all the deepest in this...
Right
... the kernel space in the Windows ecosystem, and there's a lot of things that can go wrong. I don't know all the, the details of what exactly went wrong in their process. I can tell you, in our products, in Cylance, because of our machine learning first approach...
Mm-hmm.
Right? As soon as our product kicks off, the first thing it's doing is just checking against different machine learning models.
Yeah.
There is no deep underlying stuff that we gotta keep updating, and we pride ourselves on, those models don't have to be updated.
Mm-hmm.
Right? We still have models that are running on Windows XP machines from six years ago and blocking modern threats.
Right.
So...
Interesting.
Yeah.
Yeah. How do you, like, maintain pace on the AI, ML side of things? 'Cause I think I clearly remember back when Cylance was a standalone company, they were the leader in AI, ML, and the next-gen antivirus side of things. So, what have you been doing on the investment side to maintain that strength and leadership in AI?
Yeah, I think, for a few years post-acquisition, it got lost in the BlackBerry shuffle.
Mm-hmm.
I've refocused that team. We've added some additional talent that we had across the organization and just focused ourselves on solving some of the problems. We hadn't actually done any model updates for a while, but we're now. We've already filed 4 more patents this year...
Mm
... on ML topics.
Mm.
So, really starting to roll and now applying that into broader spaces like the XDR space as well.
Yeah. Competitive environment, it's a highly competitive environment. The market's consolidated. What do you see competitively? Where are you finding the opportunities to pick your spots, have a competitive edge? W hether it's verticals, geos, et cetera.
Yeah.
Where do you find your advantage?
I think that that's been part of our shift in how we got to some of the cost structure savings as well...
Yeah
...is really, I spent a lot of time just studying what segments of the market, what verticals?
Mm-hmm.
Where did we see the most attraction to our product? Understanding why. So we continue to see a lot of opportunities in places where I'd say they still have a lot of older legacy devices.
Mm-hmm.
Because of our ability to bring machine learning back to all the way to Windows XP and Linux experience from back then.
Do it on the endpoint as opposed, like, doing it in the cloud, essentially.
Yeah. On the endpoint, and do it offline.
Yeah.
Many of these devices aren't connected...
Right
...to the cloud.
Right.
We've done repeated tests showing that our efficacy, like, barely differs when you go online or offline.
Mm.
That's because the foundational piece of Cylance was that the ML model they built...
Mm
...was for the endpoint first.
Mm.
Many other companies built it in the cloud first, and it was so big that they had to build smaller versions for the endpoint.
Yeah.
We built one that worked on the endpoint, so it's the same one that runs in the cloud.
Any questions before I keep going? On the go-to-market side, maybe for both you and you both, what are you doing on the go-to-market side to drive more awareness of Cylance? To me, when I was walking the RSA floor, I saw that Cylance brand pick back up. So, but big picture, what are you doing on the go-to-market side to drive that ARR growth that you're starting to see?
Yeah. I'll start. Effectively, like I said, we've focused. The number of sales plays, we've kind of slimmed that down...
Mm
Quite significantly. So managed services, MDR, that is one of the key focus areas. It's somewhat small, but it's growing fast. So, we're trying to get our, our direct sales force and also indirect to...
Mm
...to focus on that opportunity. Then at the other end of the scale, predominantly, like the MDR is very much a middle market...
Yeah
sort of SMB type thing. At the other end of the scale, we had great success last year with large government deployments, including the government of Malaysia, who bought all four elements of our portfolio. So, we're looking to replicate that with large governments as well. So that's a different type of sales motion, and we've got a team of people who are going around focusing on that type of thing as well.
Yeah.
So, I'd say it's narrowed, and it's a lot clearer. In the past, we tried to do an awful lot of things.
Yeah.
Many more sales plays, and yeah, we've allowed our sales team to sell all four components of this, the cyber portfolio.
Mm-hmm.
So, if you're in the customer, you're having a meaningful conversation, you can introduce all the other different angles. So that's kind of, that's the key focus. Anything to add, Nate?
No, I'd say to, just to clarify that, prior to this year, we had, like, individual teams...
Yeah
selling different parts of it
Product specialists
... different segments, and we were trying to cover every segment of the market...
Yeah
on all the products.
Right.
We just whittled it down. Again, we looked at the data, saw where we were the strongest, and said, "Have we tapped out that market yet?
Yeah.
No. Well, let's go focus. Focus our marketing, focus our salespeople.
Yeah.
And then the indirect side, I mean, channel's big in security. So what's your presence in the channel or investment on that side of things?
Yeah, I think, channel is one where we brought in a new leader at the start of the year to run our channel.
Mm.
He's been rebuilding a lot of the programs, again, in the same vein, though, of focus.
Yeah.
Right. What are the partners we need for each of the different products in the different verticals and routes to market that we're going?
Mm.
We've been building that momentum throughout the year so far.
Yeah. Couple of minutes left. From a macro perspective, I mean, cyber is always the beneficiary of being resilient. We had some conversations at the conference this week, our IT leadership and some channel folks that, like, just the cyber budget is always resilient. What are you seeing from that perspective on cyber budgets and maybe a little bit more holistically on macro?
It's one of the last things to be cut, which is a good place to be.
Yeah.
No one wants to be the CEO who's having to report to their customer base that all their data's been exfiltrated and...
Yeah
... shared on the dark web. So, it's robust, but I'd say the key dynamic for us, Eric, has been an elongation in sales cycle.
Mm-hmm.
Something that not only us, but pretty much all our peers have been saying for some time now.
Right.
It just takes longer to get to a deal.
But stable, like, in terms of where we've been?
Well, I'd say, yeah.
Stable, but, yeah, again...
Still challenging
... the deals are taking longer. They're, they're, you know, sometimes the customer wants an extra 90 days, right?
Mm.
Because they couldn't quite make the decision.
Yeah. In the last few, in a minute here or so, anything else you guys would like to share about the story that maybe investors aren't appreciating, or as you're trying to resurface, maybe the security side of the house and...
Right
... as you segmented the business and I don't know, you said a lot of shareholder value to be unlocked and...
Oh, 100%. I mean, if we look at the stock price right now, and everyone can take their own view on it...
Yeah
... but certainly, when I look at it, I see there's an awful lot of value to be had. The company is very underappreciated right now. We've got a very strong business on the QNX side, and arguably, that is the market cap in itself, if not more. And then the cyber business has been overlooked, and to an extent, we can understand it. The metrics have not been performing as strongly, but we're seeing some progress there.
Yeah.
Just directionally, slash the burn, the cash burn year-over-year is significant difference.
Mm-hmm.
I don't think the market has yet appreciated the change that we've gone through. My job and the team's job is obviously to get that message out there...
Yeah
...and to continue to improve the underlying fundamentals of the business.
Yeah. So it's been strong progress, so looking forward to seeing it. All right. Thanks. Thanks, Tim. Thanks, Nathan.