All right. Good morning, everyone. I am Sanjit Singh. I am the U.S.-based infrastructure software analyst on the Morgan Stanley software research team. Our next presentation is with Akamai, and we're super thrilled to have the CEO and co-founder of Akamai, Tom Leighton. Tom, thank you for joining us today.
Nice to be here.
So Akamai is, you know, built using its capabilities in building large-scale distributed systems to attack the security market, to attack the compute market, to attack the delivery market. I want to start the conversation and spend some time on the security opportunity because it's a business that's now crossed a $1.8 billion run rate, and it looks like you're on the cusp of security becoming, you know, almost 50% or crossing 50% of your business. Maybe just to sort of set the stage, you guys have been in the security market for just around a decade, and if we take ourselves back to that time, you know, Akamai starting in the CDN market, what was sort of the initial thoughts about moving into security?
Like, what gave Akamai a license to become a security player coming from CDN?
Well, technically, it made a lot of sense. You know, we built a massively distributed platform with 4,000 POPs in 750 cities, initially to distribute content. And so whenever anybody would go to get content from one of our customers, all that communication would go through our edge server. And that's the perfect place to apply security, you know, to filter out the DDoS attacks, to filter out the application layer attacks. You know, you're delivering it this way, but the attacks coming in are also passing through our servers. So why not, you know, put that first layer of defense there? So it just made a ton of sense. Now, the actual buyer within the account would be different. Ultimately, it goes up to the CIO and CISO, so that was a little bit of a challenge.
It was hard to get started commercially because before Akamai, everybody would buy a box for web app firewall, and they'd put it in their data center, and they'd hire somebody to manage it. And of course, the challenge was that as you got higher volume attacks, it would overwhelm the data center, and you had this, you know, single point of failure, the congestion point, and so much better to do it in the cloud. But ultimately, after some high-profile outages due to DDoS attacks, the world caught on that, yeah, it's much better to do it in the cloud. And now, even to this day, we're the leader by far in cloud services to do that kind of security.
Yeah. And if we sort of bring it up to today, you know, after a period of seeing some decelerating growth in your security business, this year has been a different story. The security business has accelerated for multiple quarters in a row now. I think last quarter was 19% constant currency growth in the security business. That's against the security market, which is mixed, and so I guess the question is like: why is the Akamai security business, you know, executing this well in this environment?
Well, we have the market-leading security products in several categories. We're the leader by a good margin in web app firewall, leader by far in bot management, you know, leader in DDoS prevention, and more recently, the leader by a good margin in micro-segmentation. And so when you have the leading products combined with a market where you're seeing more and more attacks and really devastating attacks, that's a good environment for selling security products and services. And, you know, you look now, you got Gen AI out there, and that gives a real asymmetric advantage to the attackers. You're seeing already more penetrations, and so having the market-leading products there makes a big difference for us.
I want to talk about micro-segmentation and up 97% year-over-year. It's, you know, the run rate is now eclipsing $100 million. What is the problem that Guardicore addresses for customers?
Yeah. So the problem are things like ransomware and data exfiltration malware, and it today is just painfully easy for the attacker to get the malware inside the enterprise. Even easier now, with Gen AI and the tools the attacker has available. And so you need the inner layer of defense, first to detect that a device or an application's been penetrated, so you can go get it cleaned up, and also to proactively block the spread. So, you know, ransomware is not so bad if it only gets into one machine. It's when it spreads to the whole enterprise and locks everything down, that you're in big trouble. Same with data exfiltration malware. If you just get into the HVAC system, who cares?
But from there, the malware spreads, gathers all the critical data, and exfiltrates it, and now you've got a full-blown disaster. And that's what Guardicore stops. It stops the spread and notifies you when you've got something that looks fishy or you've got an infection. I think that's now widely recognized. So you start to see, you know, the regulatory authorities requiring it for critical infrastructure companies. You know, the solution, the Guardicore solution, is fundamentally different and better than traditional approaches, which were based on physical segmentation and firewalls physically put between network segments. Horribly inflexible, really hard to do, and so people didn't really do it effectively. Guardicore, all software-based, you know, much easier to use. You can make instant configuration changes, and so that's why I think it's so popular and growing rapidly.
In terms of, like, securing east-west traffic and the sort of micro-segmentation, the first time I came across that was when VMware, you know, bought Nicira and its NSX product. And I'm sort of thinking about, you know, given the type of growth that you're seeing right now in Guardicore, it sort of begs the question: how big is this market? You know, is, you know, looking at, like, what NSX became a, you know, billion-dollar plus business. Could this be a billion-dollar plus business for Akamai?
I think if you look, you know, more broadly, like, for example, combine east-west with north-south, and we have a very good north-south product. You know, starting in Q1, it'll be on the same pane of glass. Increasingly, customers have been interested in that, so you have one control plane for north, south, east, west. So I think if you look at the broader market there, yeah, potentially, it gets to be that large.
The strength that you're seeing, going back to that theme of, like, you know, this has been a year of re-acceleration in the security business. It hasn't been all just Guardicore. I think on the last earnings call, you mentioned that the web application firewall business is doing well. For people who are a little less familiar with Akamai's security business, can you break down the different opportunities Akamai has in security and sort of stack rank them from what's most compelling from a growth contribution standpoint versus products which are more mature?
Yeah, you can think of our security products as sort of being in three layers or three pillars. The first would be stopping the DDoS attacks. For example, the Prolexic service, securing your DNS, and that's the most mature, slower growing. You know, it's not our largest security business. Now, this past year, you know, the KillNet attacks came out, and in the U.S., took out a lot of major medical centers, and so we got a lot of... You know, those folks became Akamai customers for the first time. KillNet targeted different kinds of enterprises in different geographies. So we did get a boost from that, where we took on new customers. But generally, that's a slower-growing, more mature business.
Then the next layer of defense is keeping the malware from getting inside the enterprise as best we can, and that's where you have web app firewall, bot management, account protection. That's our biggest, you know, source of revenue, basically around $1 billion or so. And we have the market-leading products there. We're building on new capabilities on top. Now, web app firewall is more mature now. You know, we've been doing that for over a decade, and the market leader by far, so there's always more opportunity to grow, but it's not nascent. Bot manager doing very well on top of that now, about $250 million, and newer capabilities that are fast-growing, but small. And so that's the big source of revenue, and so dollars of growth would be the biggest.
And then you have inside, you know, the enterprise, the last layer of defense, keeping the malware from spreading once it gets in and identifying it's there, and that's led with Guardicore.
Yeah.
So very rapidly growing, but on a smaller number.
If we go back to the 2022 Analyst Day, and it's, it was a little bit of different environment back then, but, you know, the team targeted about a 20%, growth opportunity in security over a three to five year horizon, which assumes some level of M&A. Given that the business is just, you know, sort of straddling that 20% growth mark, and as I mentioned, 19% constant currency, in the most recent quarter, what areas of security do you feel like you need to, you know, have better presence in to get back up to, to that 20%+ CAGR?
Well, you know, we're always looking for opportunities, both with organic investment and with M&A. And of course, recently we acquired Neosec, which is in the area of API security, and our goal there, it's a very nascent market, but I think very important. I think over the longer run, it could be as large or larger than the web app firewall market, which is our leading product today. You know, and I think we have an opportunity to be the market leader there. You know, our primary competition is startups, and, you know, we're already in a very trusted position with a lot of the world's leading enterprises with web app firewall.
And so we're doing a lot of investment now around Neosec, integrating it with our web app firewall, in fact, so that we can give customers visibility into what APIs they have.
Yeah.
Most CIOs, you talk to them, they don't even know all the APIs that their developers have exposed-
Mm-hmm.
Never mind which ones are vulnerable or even being attacked, and a lot of the recent headlines are from attackers exploiting vulnerabilities in, you know, the APIs. So that's the kind of thing where we're, you know, making investments. There was a little bit of M&A, relatively speaking, a lot of organic investment around it. I think in enterprise security, there's some, you know, interesting areas there, very rapidly evolving landscape, and so, you know, potentially opportunities with startups with, you know, very cool capabilities that we can integrate to our platform and help our customers stay safe.
Tom, I wanted to follow up on a point that you made in answering one of the questions about GenAI, you know, as essentially becoming a new attack vector-
Yeah.
driving, you know, you know, a lot of demand for Akamai's security solutions. How about GenAI as a way to make your security product more capable? What's your sort of initial thoughts there in terms of infusing GenAI into across the security portfolio?
Yeah, it's a great question. You know, we've been using traditional AI and machine learning for a long time, really since, you know, the beginning, for our security products. And I think traditional AI was a big asymmetric advantage to the defender. You know, we use it to find anomalies. We use it to detect, is it a bot or a human that's accessing the account? We use it to detect that, hey, it, it's a human, but it's the wrong human that has stolen credentials. So very valuable, you know, for our security products. Not so helpful to the attacker. Then you get Gen AI, and I think that changes, you know, because with Gen AI, you, you can use it to create really nasty bots, that you can very quickly train a bot to get around all the defenses.
And so that helps the attacker. You know, you got WormGPT, GPT, all these variations that are widely available tools. You can take existing malware and morph it into a lot of different forms, some of which won't get detected. And now you don't have to be very sophisticated to do it. It's really remarkable that, you know, that AI can do that successfully. And so we're already seeing the impact of that with more penetrations. On the defensive side, as yet, you know, maybe improves efficiency a little bit, doesn't fundamentally change the tools. Is my mic not working or yours? Okay.
Test. All right. Sorry, sorry for the disruption. You wanna, do you wanna finish your thought, Tom?
Do what?
Did you wanna finish your thought?
Nope, that's good. Yep, I'm good.
So maybe we've talked about the compute business. I think, was it August 2022, you announced the acquisition, or early in 2022, you announced the acquisition of Linode, which would get you into the cloud computing game. I think it surprised a lot of people. What were sort of the initial set of capabilities you believe the team needed to develop and deliver to become a viable provider of cloud computing, and what's been the progress against that initial checklist of items?
Yeah, Linode was designed for small and medium business and for developers, and they were very good at that. They were the best capability, really easy to use, you know, spin up a VM or a container, you know, very quickly. Very popular with developers. Now, what we want to do is offer compute to our customer base, the world's biggest enterprises, for their mission-critical applications. And of course, the market there is much, much larger. You know, you look at the hyperscalers, and just for infrastructure as a service is well north of $100 billion a year, growing at a very strong clip, over 20%. But there's a big difference between offering containers and VMs to developers for not mission-critical applications and doing it for the big enterprises, for their core business.
So we've had to build out a lot of scale 'cause they operate at a much higher level. And so now we're up to about 24 core data centers, which puts us in the same level as the hyperscalers. You know, things like just storage, object storage. We had to do improvements there to get several orders of magnitude improvement in the input-output rate, you know, uploads and download rates and the number of objects you can store. We had to get the certifications in place, which we're pretty much done with now. You know, the ISO standard, SOC 2, we have PCI compliance for our utilization. In fact, we're now using it for our Bot Manager solution. So in fact, hundreds of our customers are using our cloud without even thinking about it.
We don't have PCI compliance yet for general usage, but that'll come early next year. Other capabilities like, you know, virtual private cloud, availability zones, the marketplace, you know, third-party applications available as managed services. So a lot, a lot of work that we're putting into that. And we're at the stage now where we can start taking on really meaningful applications, you know, from big enterprises. So just starting that at this point, and there's a lot of work still to do. We've done most of the initial build-out, so that big CapEx spend that mostly is behind us now. We still have a little bit to go with upgrading the original Linode data centers, which we're gonna do probably six of those upgrade. We have a little bit of work to go as we deploy our...
The compute capabilities into our edge regions, which I think is a really exciting development. You know, we're in beta now with a couple customers in about a dozen edge regions, and next year, probably add several dozen more. And at that point, you know, we'll be in a position to offer to spin up your compute instances in cities and countries where there are no hyperscalers. And, you know, that'll be a big improvement in performance and opens up, you know, the marketplace. The other exciting thing is that, you know, I think we can do this at a much lower price point. At least what we can charge customers and, and make good margins and save them a lot of money. In fact, we're saving Akamai a ton of money now as we migrate out of the hyperscalers into our own cloud platform.
That was a great overview, Tom. When we sort of compare... Well, I guess the backdrop is the hyperscalers have great breadth and depth.
Yeah.
But you don't need. You can, you can generate, you know, nice revenue, but by not having to, to do everything, certainly at this early stage of the market. So I guess the question is, is like, what applications or workloads are you targeting today and trying to get customers to say, "Hey, these are the type of action, applications you can confidently migrate to Akamai?" Any, any sort of insights there?
Yeah. So, you know, at a high level, it would be applications where you care about performance, i.e., you wanna be close to end users. It would be applications that might have to scale, you know, and you don't wanna have, you know, a lot of time needed to scale, and applications that you're running at a pretty good volume, and you care about saving money... those would be the features. Now, initially, in terms of verticals, we're targeting with a focus on media, and it's because they care about those things. They care about performance, they have spiky traffic, and they care a ton about cost now. And in particular, media moves data around quite a bit, and that's where they get killed with the egress fees from the hyperscalers. And so media companies also are under a lot of price pressure.
And so here we can go and say, "Look, we're gonna give you better performance, and we're gonna save you a lot of money." And that's a pretty compelling, in these times, a very compelling, you know, value proposition. Not only that, we don't compete against our media customers, you know, and they find themselves now in the situation where they're writing checks, $hundreds of millions or $1 billion to their leading competitor. And, you know, they've decided that's not such a good idea. So that's where we're initially focusing.
Yeah. I think the one thing about 2023, you've seen a rapid pace of innovation across the ecosystem at Akamai, but across, you know, the hyperscalers, across the independent, software ecosystem, a lot of it around, GenAI. I was at the AWS conference, last week in Vegas, tons of GenAI announcements. Azure's been, you know, obviously been, you know, at the forefront of, the GenAI theme. And so I guess the question for you is, like, over the next 12-18 months, given that the industry is in high velocity innovation and investment, what are the capabilities that you guys need to roll out to make sure that you guys, you know, stay relevant, to capture the growth opportunity?
Yeah, great question. Obviously, a lot of buzz around GenAI, and I think a lot of it is deserved, actually. It is pretty exciting what it's capable of. You know, our approach with GenAI is that for training or really large models, that would be done in the core, and would be done with GPUs. For smaller, lighter weight, low latency models, for inference engines, that can be done at the edge, 'cause you wanna have the low latency. You don't need GPUs. CPUs are fine, in fact, much more efficient, much better ROI. And, you know, we do support GPUs. We are growing the GPU footprint in the core, but it's not the main focus for us.
The main focus for us is CPU-based applications, where, you know, the latency matters, it can be done closer to the edge. You know, we're working with customers. Of course, we run AI already on our edge platform and on Akamai Connected Cloud with the compute, even for things like bot management. Now, it's on our cloud. We also have partners that are selling, you know, AI solutions, and again, with probably more of a focus on you know, the lower latency kinds of applications and more of a focus on the CPU because, much better ROI. And as we get started, you know, the last thing we wanna do is go write a giant check for a bunch of GPUs, you know, no.
We're going after what we think is a much better initial market for us than media, and supporting, you know, portions of AI that make a real difference, where you want the low latency and the cost effectiveness.
Yeah, that makes ton of sense. I wanted to come back to the edge compute opportunity.
Yeah.
You know, I think there's been several players in the industry that have been touting the edge compute opportunity. It always seems like this is the year of edge computing, and sometimes it doesn't feel like we've always been there in terms of generating the revenue. I've seen developers certainly come on board to these various edge compute platforms. How do you think about the edge compute opportunity? Like, is this a significant opportunity that can be meaningful to Akamai's business over time?
Yeah, I think. Unfortunately, edge compute has been an abused term. You know, we've actually, we coined the term over 20 years ago with our first edge compute solutions. And today, most of the players that talk about it don't even have anything like what you'd think of as an edge platform. You know, we run today, you know, JavaScript applications in 4,000 POPs. Nobody else does that. We spin up JavaScript apps in a few milliseconds based on end-user demand. Nobody does that in all those locations. Now, if you define edge computing to be that, you know, it's a nice market. It's growing in usefulness. We do some very cool applications with it, but 99% of the revenue is not that.
It's, you know, spinning up your containers and your VMs today in core data centers, but I think, you know, we wanna see that happen closer to the end user. That's where the revenue is, and of course, a big reason why we're making the investment to support containers and VMs and move that closer to the edge.
What do you think will be the tipping point or the inflection point, for enterprises to look at, you know, building more applications at the edge?
Again, depends how you define the edge. I think it'll be a, you know, a long time before JavaScript capabilities, for example, overtake revenue from, you know, core cloud compute, VMs, and containers. I mean, it's off by two to three orders of magnitude, so you have a long time there. That said, we do cool things. You know, for example, if you're an apparel website, all right? When that user first comes to you, you don't even know who they are. You want to give them a good impression, sell something. Now, one of the things we do for several customers is we go get the local weather forecast, and what we show the end user varies.
If it's 20 degrees and snowing, what you show that user probably is different than if it's 80 degrees and sunny or 60 degrees and raining on the first page, okay? And so we use edge computing to tailor the content based on what our customer wants us to do. And then, as the user engages with the site, you start to learn more, and again, edge computing to tailor what the user sees. We use it for video. When you watch certain live video, we're actually tailoring the experience you get and the quality you get, you know, at the edge, near you, in our 4,000 or hundreds, certainly hundreds of POPs for video.
I think there's a lot of cool use cases like that, but still today, you know, being able to have support of, you know, containers and VMs and Kubernetes, you know, two to three orders of magnitude more revenue there. And so our goal is to tap into that market, which is very large, and then make that available much closer to the end user than you get with the hyperscalers.
Great. Let's talk about the delivery business, which is now just under 40% of Akamai's revenue. I think what's interesting to me is that in recent months, you've seen two, you know, consequential players exit the market. So the question is, why are people exiting the delivery market? And should we expect further consolidation in the category moving forward?
Yeah, I would have thought the consolidation would have happened 15 years ago, and pretty much every year over the last 15 years, 'cause there's a zillion competitors, and they're all losing money. And, you know, maybe that was okay when you could borrow money for free and hope that you could flip the company. You know, you'd make it in a sale somehow. But I think now that interest rates went up and you see some of these players have been at it for a long time, not making money, and there's no real exit strategy, that they decided to get out. So in this case, you know, both Lumen and StackPath, totally separately, you know, approached us. They wanted to keep the customers happy 'cause they're still in business.
It was a situation where they wanted the customers to have a quick and good transition. So they, you know, they went to us because we're the market leader by far, and the financial terms were compelling to take on the customers. So good for the customer, good for us and our shareholders, and it was good for them. And, yeah, I would suspect, you know, if economic conditions stay the same or worsen, there'll be other companies that decide it just doesn't make sense. Of course, you still got the hyperscalers out there, and, you know, obviously they're not going away. And in many cases, they'll give delivery away for free just to get the compute business 'cause there's so much value there.
Yeah, that was gonna be my follow-up question, which is: are you optimistic that pricing, you know, starts to look better for Akamai, given kind of the state of the delivery market, over time?
It's still very competitive. You know, we've been in the business now 25 years since we created it. Still very competitive. Now, we are being, you know, more. I would say tough in terms of the business that we'll take at price point. So as you know, we've walked away from some of the spikier traffic where the economics aren't so good, 'cause when you get the spike, you gotta pay a lot to build out the capacity, and then it's sitting there, you know, until you can fill it up with the day-to-day growth. And so as you've seen, the CapEx for our delivery platform has dropped substantially as a percentage of revenue. Also, the really low-price stuff, you know, we're not taking, so our margins improve.
It hurts revenue some, you know, in the delivery business, but the growth vectors in revenue for us are obviously security and compute, and the ROI on the CapEx is much better for compute. So you see us, you know, shifting the resources, you know, from the delivery and taking the low price or spiky stuff into compute and investing in security capabilities.
Awesome. With 30 seconds left, can you just give us a sense of CapEx, where is it, where has it been, and where is it headed, you know, near term and forward and medium term?
Yeah. So CapEx in the delivery business has declined from high single digits to low to mid, and our goal is to keep it at a lower level. We had a huge increase in CapEx for compute early this year as we did the initial build-out. That basically, most of that is done. And we... Now, as we fill that capacity with revenue, that'll be very nice for us, and then we would build more capacity. So you'd see CapEx, you know, grow once we start getting revenue there. So those are the two things that have happened in CapEx.
Thank you much, so much, Tom, for the conversation. Really appreciate it.
Great. Thank you.
Thank you.