Before we go into the numbers, I would like to talk about our disclosure changes, mostly about my presentation slides. Disclosure is being changed because of the change in the nature of the business. What has really changed? This is something that's been continuing from last year. Trend AI and TrendLife. Two brands have been established. Enterprise business focus is now shifting to AI security and also for consumers, we have our digital life security market expanding. In order to cover those two aspects, we have established these two brands, and the strategy will be different, more different between the two going forward. The nature of the business has shifted to subscription or more. Core sales and pre-GAAP sales, we have been discussing this type of information, but we believe that ARR would make more sense to our investors.
The second point, in the era of AI, many new business opportunities will arise. Therefore, to be able to actually invest into that, we want to do incubation business. Kevin's slides will cover some of this in greater details. We are starting incubation business and we are investing for new markets. This kind of upfront investment, of course, will impact the consolidated operating profit. Therefore, we need to provide an explanation to our investors. Also, pre-GAAP will be stopped and the explanation will be focused on ARR. Now, incubation investment, what is the size of that impact? We want to show that at the management P&L level. This is non-GAAP numbers that we're talking about. This means that I will be focusing mostly on Kevin's slides. Moving on to the Q1 results.
Net sales up by 9% and operating income up by 4%. Well, higher sales and a lower profit was always the plan. You may think that this is slight improvement over that. First of all, we have the impact of FX, weaker yen. As you can see at the bottom of the slide, if we exclude the impact of FX, net sales increased by 3%. The other thing is, the share price has changed. Some of the costs that are related to share price are coming back to P&L. Considering that, this is a negative 4% in terms of operating income. What is happening recently? On the left-hand side, you can see 24% against the total annual sales. This is a progress.
Operating income is at 28% of the total, which is higher than the prior year. As I said before, share price has declined, and it had impact of about JPY 1.2 billion. Combining that, operating profit was basically negative 4%. ARR. Up until last year, we were just, like, disclosing information of ARR for enterprise business, but now this is ARR for Trend AI. Basically no difference. There are some footnotes here. 99%, this is the same as what we showed before. I don't think there is a problem comparing this to the prior year numbers. We will continue to present the numbers in this way going forward. ARR growth. Well, it was about 3% at one point, but now it's recovering slowly.
Leading up to the second half of the year, we expect this growth rate to go higher. This is ARR by region. Excluding Americas, in all the regions we see growth in ARR. There are different factors for Americas. I'm sure that Kevin's presentation will cover this. We are seeing some improvements compared to before, but still in the negative territory in this quarter. Cash flow. Growth rate looks high, but well, in the fourth quarter, there was a big sale, so we are collecting ARR, as you can see. Now, headcount. There was slight decline last year, but going forward it will be flat or it will slightly increase because we're hiring. We expect the headcount to increase somewhat. Moving on to the cost changes. Well, FX impact is announced.
JPY 3.8 billion cost and about half of that is FX. The cloud cost is also increasing, as you can see. Impacted partly by FX, but cloud usage is increasing over time. This is not just negative factors because we have Vision One platform that we provide and customers start to use more and more features related to AI. Which means that this is how we can deliver value from Trend Micro, which is used by our customers. That means that cloud cost will continue to increase, but this is in line with our user base expansion. This is the evidence that our user base is using our cloud functions. This is a positive factor, and this pushes up the net sales. This is a summary for the Q1 highlight.
We had the highest ever quarterly net sales. If we look at just Q1, over time, this was the highest Q1 operating income and net income. Moving on to the full year forecast, this hasn't really changed. 9% growth in net sales and the -2% in operating income. That's all from me. I would like to ask Eva to take over because there's a very topical, theme that should be covered. Back to you.
Okay. I think, for any company now, the most important question to ask is what is your AI strategy in this new AI era? I'd like to take a few minutes to explain how Trend Micro are dealing with AI attack and also how we utilize AI to defense against the new threats. Next page, please. Last month when Anthropic announced that they have this Mythos, very powerful model and can find a lot of zero-day vulnerability, it send a storm across all the cybersecurity industry. People are asking, How are we going to deal with this AI-powered security? Also, what is cybersecurity companies want to protect our own business? I'd like to say actually vulnerability, finding vulnerability of course is a very important part, but defense against all this vulnerability is not stop at just finding it.
The more important thing is how to help customer mitigate against all of this vulnerability, against the hackers, the bad guys attacking it. As you can see in this chart, the red line is the total vulnerability, all the vulnerability that has been found. The most alerting part is the yellow line down below there. That is the capability of customer to deploy the patch and mitigate against all this vulnerability. This gap between the red line and the yellow line is where cybersecurity company need to do. It's not just finding the vulnerability. The process in between finding vulnerability, creating protection before customer can deploy their patch is the most important process in cybersecurity. Next page, please.
This is between customer being disclosed and they know there's vulnerability and the vendors issue the patches and customer can really apply all these patches onto their environment to defense against these attacks that actually take a long time. Next, please. Even I think, two years ago, we talk about this vulnerability called the Log4j. Until now, Log4j and there's patches several times, but until now there's still millions of server that cannot be patched because there's so many applications in that upon it, and it's so many compatibility problem that cannot be patched. This timeline show you between the customer applied patch and the real protection is already in place to protect against the or this possible attack. There's a need for providing what we call virtual patch.
Virtual patch means that cybersecurity company will analyze all this vulnerability, and then we simulate what is a possible attack attacker will do, and then using virtual patch in front of those vulnerable system to protect against all those actual attack. That is what cybersecurity company need to do.
That is also why after Mythos, Anthropic immediately come to cybersecurity company like Trend Micro and work with Trend Micro to focus on how do we apply all this process of announcing the vulnerability to the software vendor and develop the simulated exploits, develop the virtual patch, and deploy those virtual patch onto the cybersecurity product such as Trend Micro's TippingPoint or our Deep Security product or Vision One endpoint protection, all need this virtual patch to defense against the possible attack on the vulnerability. In order to do this, you need two type of core competence, which first one, understand and develop the possible exploit that rely on the threat knowledge that cybersecurity company especially have. Of course, we are using AI to accelerate all of this development, but that special knowledge is needed to develop this type of virtual patch.
Next page. The second important thing is understand customer's environment because the initial attack usually is attack on the human and organization vulnerability. This table shows that in the past few years, the top 10 most important, most impactful security instance happened in the world and none of them, the initial exploit come from the zero-day vulnerability. It come from all the organization and human error, configuration error. All of this vulnerability, organization and human vulnerability require the understanding of each of the customer environment and where and how they can apply all of this virtual patch or protection agent into their environment. That's what Trend Micro and other cybersecurity company are working on and has all of the capability to help customer really protect their environment.
One, domain knowledge about the threat, how attacker will attack and domain knowledge about specific each of the customer's environment. What is the best way to apply the protection against all this attack path? Those are the two important modes of cybersecurity company. Next page. I think Trend Micro been in cybersecurity for 38 years, and we has been investing in utilizing AI to protect against all the different threats. Next page, please. You can see that Trend Micro in the past few years already invest a lot by utilizing AI to develop, accelerate our virtual patch deployment and helping our customer defense against all of this human and organization vulnerability.
That's why we believe the question that customer or, I mean, investor should ask is not how AI will replace cybersecurity, but ask if cybersecurity company has been using AI to defend against all of this new AI-driven attack. Trend Micro has been investing here for our digital twin Trend Vision One platform are all very advanced in utilizing AI to defend all of this attack. You can see this event is a TrendAI Spark event, and on the stage is Trend Micro's TrendAI Chief Business Officer, Rachel, with Anthropic, NVIDIA and AWS. We are on the stage together explaining how this in the AI ecosystem, how cybersecurity should act and work with AI infrastructure vendor to help their customer safely, securely deploy their AI application in their organization.
AI security is the essential part of AI ecosystem, and we are very confident that Trend Micro, TrendAI, TrendLife already in the forefront of developing all of this AI-driven cybersecurity to protect customer in the agentic AI era. That's my AI strategy for Trend Micro is we utilizing AI and will help customer safely. We call it like a bridge over troubled water, bridge customer moving from the old infrastructure onto the AI infrastructure. That's our AI strategy. Thank you. Next, I think we will pass to Kevin's video to explain how we execute in Q1.
I have two questions. One is, Mythos. Big topic and also a big theme. I understand that you have a strategic relationship with Anthropic, but you're not a founding partner of a Glasswing. From that perspective, founding partner of the project, for example, compared to CrowdStrike, I see maybe a competitive gap where you're behind them. Is that true? Or because you have strategic partnership there is no gap?
What about middle-sized players? Do you have advantage over some other players because you have a relationship with Anthropic? Can you please talk about the competitive environment?
Maybe I will take the question. On Mythos, of course, I don't know what they were doing in the founding member part. After we joined and worked with Anthropic, we've been working with them on our ZDI organization, talking about finding the vulnerability and how to handle all this software vulnerability process. I think that is a very important part. Like I say, Mythos, when they were developing this model and very powerful in analyzing all the code, and one of the functionality in Mythos is finding the vulnerability or the bugs in the code, which is what Glasswing's founding member was focusing on. I don't think that is a technical gap for Trend Micro to catch up, because what customers really care about is that security gap.
That by finding the vulnerability and mitigate the vulnerability, that is the part that customer really need and Trend Micro is leading on providing that type of virtual patch and working with Anthropic to starting from finding vulnerability and then writing a virtual patch. That is the most important part for our business and our customers. That's what my answer about Mythos. I don't think that is a technical gap that inhibit our Trend Micro's cybersecurity solution to be ahead. That's the first answer. The second question, I'm sorry.
Oh, sorry.
That was my first question. I haven't asked my second question yet.
Okay.
If it's I would like to start the second question, if that's okay.
Okay.
Thank you.
My impression is that the company performance was pretty good. If you look at Japan, the domestic business, cybersecurity is very exciting right now. Enterprise business growth in Japan, according to J-GAAP, is actually - 9% according to my understanding. Is this the impact of a segment change or do you have to be concerned about your lack of competitiveness in this environment?
Omikawa-san, can you please respond to this question?
May I?
Oh, yeah, please.
Yeah. Yes. Yes, there is a big gap between Because Japan is the biggest, Japan is our biggest market for Cloud Edge, which will move the Cloud Edge from enterprise business onto the TrendLife, the consumer business, small business. I think there is a gap between that because of that move. It only impacts Japan because Cloud Edge is only selling in Japan.
Understood. Thank you. Excluding that segment change, enterprise business in Japan is actually growing positively. Is that the correct understanding? Omikawa-san, this number is adjusted, correct?
Yes. Cloud Edge was retrospective adjusted, so this is an apple- to- apple comparison. Yes.
Another big factor is that this is an internal view, but there are larger deals and we expecting them to materialize in the first quarter, but it didn't or they didn't, so we expecting that to happen in the second quarter. That's another factor. Understand clearly. Thank you very much.
This is a retrospective adjustment. I understand. That's all from me. Thank you.
Thank you for your question. Let's move on to the next question.
Can you hear me? I have one question. There are various data by region. I'm not so clear what was the good news and bad news. New TrendAI, ARR, and when you look at the ARR of other new
Excuse me, your sound is not very clear. I cannot hear you very clearly.
Can you hear me? Could you say, repeat your question? How to read some of those information by region, if you can comment on each region. For example, U.S., is it recovering or better than expected? European numbers seems strong, but in the previous earnings call it was not so good. I think it was still weak. Is it improving in Europe? Also I think Middle East is also included, but the number seems quite strong. By region, if you can explain the macroeconomic condition and your business environment. If you can give me the update, that would be very much appreciated.
Okay, I can start and others can jump in. Overall, the backdrop is that what I was trying to explain in my video recording is that we've made a fairly dramatic change in our business going forward in 2026, and that is moving away from this focus on pre-GAAP gross sales to an AR model. Historically, we have done a lot of multi-year transactions, and in fact, in some of the regions it was up substantially the number of multi-year transactions. Now we're much more focused in on, you know, go-to-market teams are fixated on growing ARR, so growing that annual recurring revenue stream. If we go across the globe, I'll just start at the top. You already mentioned it. In our Asia Pacific, Middle East and Africa business, AMEA, it was up double digits, and it has been historically up double digits.
We continue to drive really, really healthy ARR growth in the Middle East and Southeast and Southeast Asia, excluding Japan. In Europe, we were a little bit higher growth than previous quarters. Europe continued to perform well. In Japan, you already saw the numbers that we were talking about relative to Japan. Even doing the apples-to-apples comparison in the enterprise business, we did actually do good growth and getting the growth in the area that we want, which is for Japan to start really much more aggressively getting our Vision One platform adopted. That was up. In the Americas, that did decline. Specifically, we did see a small decline in the U.S., if you're asking about the U.S. However, we're still declaring it quite a victory.
We did grow, ever so slightly quarter-over-quarter in the U.S. That was nice to see that, you know, from Q4 to Q1. That's the first time that we've been able to actually stabilize the ARR within the U.S. We were really focused in on customer retention. We're really focused in on growing the Vision One base. If you go back and look at that one chart, the Vision One ARR within the U.S., it's the highest of all top 10 countries. It's substantial, and it's growing at 35% plus. We are really doing a nice job of growing in the right area in the U.S., and that's what we're focused in on and will continue to be focused in on.
Thank you. That's all.
SMBC Nikko Securities, my name is Kikuchi. I have a similar question to the ones that have been asked. Two questions. First of all, Americas ARR, enterprise TrendAI ARR year-over-year, when do you think it will turn positive? When will we start to see the positive growth? That's my first question.
Kevin?
From an Americas standpoint, I think we've done a really good job in Q1 of getting things stabilized. It's probably another quarter in order to continue the stabilization effort, but by the second half, we are going to see growth for sure in the Americas and the U.S. in particular.
Thank you. What are the factors behind that? In the second half, you said that Americas will improve. What factors will drive that in each segment and in each specific business?
There's a couple different things that we invested in at the start of this year in the TrendAI overall, but in particular in the U.S. The one is our strategy is to be very vertically focused. We have the team structured to go to market in a very vertically oriented way now. That aligns well with the channel partners that we do most of our business with. That was an important step, and we've made that step in January. The second thing that we've done is we've invested substantially in the channel. That had been an area that we had been historically under-investing in, and we've identified the strategic channel partners that we feel are going to have the biggest impact on our business in the U.S.
We've increased our headcount and discretionary spend for those channel partners. We've started to do that in Q1. The reason why I say the second half is because we need time for those investments to start to work. That said, I do want to highlight the Trend Vision One growth that we're getting in the U.S. is substantial. As that continues to build, we know that the Trend Vision One platform offers a better and easier way for us to expand and add more value and solve more customer pain points. We also know that the retention rate is higher. That's why we're really fixated on growing Trend Vision One even more in the U.S., and that will eventually start to give us positive results.
We may see it in Q2, but I feel like the second half is when we will start to see total U.S. ARR growth kick in.
I think one of the important factor in Kevin's presentation, it shows that the total ARR in all the countries, actually U.S. is number one. Vision One ARR is number one, and that is a base. As we can see, once they get onto Vision One, then the expansion rate, retention rate is much better. Based on that capability, the first one you can see, then we believe that's why we believe this year U.S. will turn positive in ARR growth because of the base of Vision One ARR is expanding.
Thank you very much. My second question. Kevin, you said that in 2028 I think you are aiming for operating margin target of over 25%-27%. In 2027, based on the current level of investment, I know that you're investing quite a lot right now. In 2027, margin will be higher than 2026. Is that the correct understanding? In order to achieve the target in 2028, the margin will have to go up in 27. Is that the correct understanding?
Yes, your understanding is correct. You know, it's our plan to invest more in the first half of this year in particular. You know, we will see some softening in the overall operating margin this year, and that's our 19% guidance. Of course, we will provide 2027 guidance at the end of the year, at the end of this year. Yes, it is our intention to gradually increase the operating margin over time.
That's all from me. Thank you.