Good day, ladies and gentlemen, and welcome to Akamai Technologies, Inc. Third Quarter 2021 Earnings Conference Call. At this time, all participants are in a listen-only mode. Later, we will conduct a question and answer session and instructions will follow at that time. If anyone should require assistance during the conference, please press star zero on your telephone. As a reminder, this conference call is being recorded. I would now like to turn the conference over to Tom Barth, Head of Investor Relations. Thank you. Please go ahead.
Thank you, operator. Good afternoon, everyone, and thank you for joining Akamai's third quarter 2021 earnings conference call. Speaking today will be Tom Leighton, Akamai's Chief Executive Officer, and Ed McGowan, Akamai's Chief Financial Officer. Before we get started, please note that today's comments include forward-looking statements, including statements regarding revenue and earnings guidance. These forward-looking statements are subject to risks and uncertainties and involve a number of factors that could cause actual results to differ materially from those expressed or implied by such statements. These factors include uncertainty stemming from the COVID-19 pandemic, the integration of any acquisitions, and any impact from unexpected geopolitical developments. Additional information concerning these factors is contained in Akamai's filings with the SEC, including our annual report on Form 10-K and quarterly reports on Form 10-Q.
The forward-looking statements included in this call represent the company's view on November 2nd, 2021 . Akamai disclaims any obligation to update these statements to reflect future events or circumstances. As a reminder, we'll be referring to some non-GAAP financial metrics during today's call. A detailed reconciliation of GAAP and non-GAAP metrics can be found under the Financial portion of the Investor Relations section of akamai.com. With that, let me turn the call over to Tom.
Thanks, Tom, and thank you all for joining us today. I'm pleased to report that Akamai delivered excellent financial results in the third quarter, coming in at or above the high end of our guidance ranges for revenue, operating margin, and earnings per share. Q3 revenue was $860 million, up 9% YoY and up 8% in constant currency. Non-GAAP operating margin in Q3 was 32%, which reflects our continued focus on operational efficiency, even as we've continued to invest for future growth. Q3 non-GAAP EPS was $1.45 per diluted share, up 11% YoY.
Akamai's strong performance in Q3 was largely driven by our security business, which is now one of the leading cloud security businesses in the world, with an annualized revenue run rate of more than $1.3 billion, up 26% YoY and up 25% in constant currency. Over the last several years, we've grown our security portfolio from point solutions into a comprehensive platform that provides defense in-depth to address our customers' biggest threats. The unique breadth of our defenses is important to our customers who want more security capabilities from fewer vendors. Our security solutions are highly differentiated and recognized as best in class by our customers who see us as a leading provider of services that protect their most critical assets, including enterprise websites, applications, data, and access. We routinely earn top rankings in multiple categories from major industry analysts.
For example, Akamai disrupted the web app security market when we launched Kona Site Defender in 2012. Since then, we've continued to extend our leadership position in the web app firewall sector, with Gartner recently naming Akamai as a market leader for the fifth year in a row. Akamai has been the market leader in DDoS protection since we acquired Prolexic in 2014. Forrester recently said, "Large enterprise clients that want an experienced, trusted vendor to make their DDoS problem go away should look to Akamai." As new threat vectors have emerged, we've extended our platform to defend against them. For example, we created the first comprehensive bot management solution to protect our customers from sophisticated bot operators who try to steal content, disrupt operations, or penetrate user accounts. According to Forrester, Akamai is best for companies wanting to thwart bots at the edge.
Bloomberg Businessweek even quoted a hacker calling Akamai's bot defense the hardest to crack. More recently, we released Akamai Page Integrity Manager to identify malicious code in third-party scripts and websites that's designed to steal end user data. Page Integrity Manager helps to address a major threat that's been costing businesses hundreds of millions of dollars in fines, as well as serious reputation damage. We plan to extend our web app protections further in the coming months with the release of Account Protector and Audience Hijacking Protector. Account Protector is designed to reduce fraud by making sure that the entity logging into an account is the true owner of that account. Audience Hijacking Protector can help businesses protect sales by thwarting malware that diverts a customer just before the completion of a transaction.
Since founding Akamai over 20 years ago, our vision has always been to help our customers solve their toughest internet challenges. Today, that includes stopping ransomware. Ransomware is a huge problem for enterprises around the world, with a new attack striking every 11 seconds. The damage resulting from ransomware is expected to amount to over $20 billion this year alone. Guardicore is critical to stopping the spread of ransomware, and that's a key reason why we acquired the company. Akamai is already selling solutions such as Enterprise Application Access that help prevent attackers from gaining access to enterprise infrastructure and applications. To be secure in today's world, you also need a second layer of defense to block the spread of malware that has gained a foothold in the enterprise. That's where Guardicore comes in.
Guardicore helps detect when a breach has occurred by identifying anomalous data flows within enterprise networks. Guardicore also helps prevent the malware from spreading through a capability known as micro-segmentation. Guardicore's micro-segmentation solution limits access within the enterprise to only those applications that are authorized to communicate with one another. Denying communication as the default greatly limits the spread of malware and protects the flow of enterprise data across the network. That's the key to stopping ransomware. We believe Guardicore's best-in-class micro-segmentation solution is the perfect addition to our zero trust portfolio, enabling Akamai to offer customers a comprehensive solution to stop the damage being caused by ransomware and malware. During the call we held on September 29th, we spoke about the parallels between our acquisition of Guardicore and our acquisition of Prolexic in 2014.
Just as the acquisition of Prolexic propelled us to a leadership position in helping to stop DDoS attacks, we believe that the acquisition of Guardicore will establish Akamai as a leader in helping to stop the damage caused by ransomware as well as other forms of malware. Customers see Akamai as a strategic partner in security, not only because of the strength and breadth of our solutions, but also because of the depth of our security expertise and threat intelligence and the scale of our platform, the same platform that underpins our world-leading CDN. Akamai CDN handles over 5 trillion requests every day. In addition, we resolve more than 3 trillion DNS queries each day. This gives us unmatched real-time insight into the world's internet traffic, which we analyze to provide best-in-class threat intelligence, protection, and support.
We also have one of the industry's largest and most experienced teams of security professionals, with thousands of engineers and consultants working on security for our customers. Our security solutions are tightly integrated into the world's largest and most distributed edge platform, and that provides unmatched global scale to defend customers against not only the largest DDoS attacks, but also against the vast bot armies that are waging attacks from the edge. The integration of our security solutions with our CDN solutions also provides benefits to our customers in terms of improved performance and ease of use. With Akamai, security and performance go hand in hand. You can buy them together as a single protect and perform package, which makes purchasing and integration easy for the customer. When you buy security from Akamai, your performance is automatically improved.
That's because we apply the security layer as we are delivering the content from the world's true edge platform. This means that the processing needed for security stays close to the end user, which makes for much better performance. Akamai's unique combination of security and delivery provides a powerful offering in the market, which is one reason why we're the market leaders in both security and CDN. Our CDN business also generates substantial cash that we can use to invest in future growth, as we've recently done with the Guardicore acquisition. For example, our CDN business generated revenue of $526 million in Q3 and contributed substantially to our overall free cash flow of $273 million, enough to cover almost half of what we spent to acquire Guardicore.
We believe that having the world's largest and most distributed edge network also provides a great foundation for the growth of our Edge Applications business. As 5G rolls out, as IoT applications proliferate, and as more data is created and processed at the edge, Akamai's edge compute platform is very well suited to support the high throughput and low latency applications that are not well served by traditional cloud providers today. From delivery and performance to compute and security, the world's leading brands want our help. That's because the Internet is getting more complicated with more traffic, higher user expectations, and more cyber threats every day. The world's leading enterprises know that Akamai can help keep their digital experiences close to their end users and the threats farther away.
They know that what we do makes life better for billions of people, billions of times a day, and that nobody powers and protects life online like Akamai. I'll now turn the call over to Ed to provide further details on our Q3 results and our outlook for the rest of the year. Ed?
Thank you, Tom. As Tom just outlined, Akamai delivered another excellent quarter. Q3 revenue was $860 million, up 9% YoY, or 8% in constant currency. Revenue was again driven by very strong results in our security business. Revenue from our Security Technology Group was $335 million, up 26% YoY, or 25% in constant currency. Security now accounts for 39% of our total revenue. Revenue from our Edge Technology Group was $526 million, flat YoY, and down 1% in constant currency. Foreign exchange fluctuations had a negative impact on revenue of $5 million on a sequential basis and positive $4 million on a YoY basis. International revenue was $412 million, up 16% YoY or 15% in constant currency.
Sales in our international markets represented 48% of total revenue in Q3, up three points from Q3 2020 and up one point from Q2 levels. Revenue from our US market was $449 million, up 3% YoY. Moving now to costs. Cash gross margin was 76% in line with our expectations. GAAP gross margin, which includes both depreciation and stock-based compensation, was 63%. Non-GAAP cash operating expenses were $261 million. Moving on to profitability. Adjusted EBITDA was $396 million. Our Adjusted EBITDA margin was 46%. Non-GAAP operating income was $277 million, and non-GAAP operating margin was 32%. Capital expenditures in Q3, excluding equity compensation and capitalized interest expense, were $129 million.
This was below our guidance range, primarily due to continued progress on network CapEx efficiency projects. GAAP net income for the third quarter was $179 million, or $1.08 of earnings per diluted share. Non-GAAP net income was $239 million, or $1.45 of earnings per diluted share, up 11% YoY, up 10% in constant currency, and $0.04 above the high end of our guidance range. Taxes included in our non-GAAP earnings were $39 million, based on a Q3 effective tax rate of approximately 14%. Moving now to cash and our use of capital. As of September 30th, our cash equivalents, and marketable securities totaled approximately $2.8 billion.
After accounting for the $2.3 billion of combined principal amounts of our two convertible notes, net cash was approximately $452 million as of September 30th. During the third quarter, we spent approximately $97 million to repurchase shares, buying back approximately 800,000 shares. We ended Q3 with approximately $321 million remaining on our current repurchase authorization, which runs through the end of this year. As noted in today's press release, our board authorized a new buyback program of up to $1.8 billion beginning January 1st, 2022, and running through the end of 2024. As we've previously discussed, our primary intention is to buy back shares to offset dilution from employee equity programs over time.
However, our repurchase authorizations also allow us to opportunistically deploy capital if or when we believe there is a valuation disconnect in the market based on business or market conditions. Combining the two authorizations, we currently have more than $2 billion available for share repurchases through the end of 2024. We believe our strong balance sheet and significant free cash flow generation, which totaled $273 million or 32% of total revenue in Q3, also provides us with significant financial flexibility to pursue a balanced capital deployment strategy. As such, we plan to continue to invest organically in R&D and product development, expand our capabilities through M&A, as you saw with our most recent acquisition of Guardicore, and return capital to shareholders via share repurchases. Moving on to Q4 guidance.
There are two factors to consider as you update your models for the fourth quarter. First, we closed the acquisition of Guardicore on October 20th. Our guidance assumes Guardicore will contribute approximately $6 million-$7 million of revenue in Q4. It also assumes that Guardicore will be approximately $0.05 dilutive to our total non-GAAP earnings per share in Q4. Second, as in prior years, seasonality plays a large role in determining our fourth quarter financial performance. We typically see higher than normal traffic for our large media customers and from seasonal online retail activity for our e-commerce customers, which are both difficult to predict. With that in mind, we are projecting Q4 revenue in the range of $883 million-$908 million, or up 4%-7% as reported, or 5%-8% in constant currency over Q4 2020.
Foreign exchange fluctuations are expected to have a negative $3 million impact on Q4 revenue compared to Q3 levels. A negative $6 million impact YoY. At these revenue levels, we expect cash gross margins of approximately 76%. Q4 non-GAAP operating expenses are projected to be $290 million-$297 million. We anticipate Q4 EBITDA margins of approximately 43%-44%. We expect non-GAAP depreciation expense to be between $120 million-$121 million. Factoring in this guidance, we expect non-GAAP operating margin of approximately 30% for Q4. Moving on to CapEx. We expect to spend approximately $128 million-$133 million excluding equity compensation in the fourth quarter. This represents less than 15% of anticipated total revenue.
With the overall revenue and spend configuration I just outlined, we expect Q4 non-GAAP EPS in the range of $1.37-$1.44. This EPS guidance assumes taxes of $38 million-$39 million based on an estimated quarterly non-GAAP tax rate of approximately 14.5%. It also reflects a fully diluted share count of approximately 164 million shares. Looking ahead to the full year, we are raising our guidance. We now expect revenue of $3.439 billion-$3.464 billion, which is up 8% YoY as reported, or up 7% in constant currency. We now expect security revenue growth to be in the mid-20% range for the full year 2021.
We are estimating non-GAAP operating margin of approximately 31% and non-GAAP earnings per diluted share of $5.63- $5.69. This non-GAAP earnings guidance is based on a non-GAAP effective tax rate of approximately 14.5%, and a fully diluted share count of approximately 164 million shares. Finally, full-year CapEx is anticipated to be approximately 16% of revenue, consistent with our prior guidance. We are very pleased to deliver another quarter of excellent financial results, and we look forward to closing out a strong 2021. Thank you. Tom and I would be happy to take your questions. Operator?
Thank you. At this time, to ask a question, you will need to press star one on your telephone keypad. Again, that is star one to ask a question. To withdraw your question, just press the pound key. Your first question comes to the line of James Fish from Piper Sandler. Your line's now open.
Hey, guys, nice quarter. Thanks for the questions. A couple of your competitors are starting to get a little bit louder on the security side with getting a foot in the door with government and zero trust architectures. I guess my question is, you know, how was the federal vertical for you this quarter, and what will it take for Akamai to become more a part of those conversations, especially when you guys already do service some government stuff?
Yeah, our government business is very strong, particularly in security. You know, we defend most all the major agencies in the government, pretty much every branch of the military. I would say we have a very strong business there.
All right. Then on Guardicore, how long until the 100+ reps are likely selling the entire security portfolio? Really also any update to the go-to-market on both security standalone sales with channel partners, as well as what you guys are doing to target developers better with Edge Applications. Thanks, guys.
Yeah. Hey, Jim, it's Ed here. I'll take the first one, and then maybe Tom can follow up on the developers. In terms of the sales force, we're gonna maintain the sales force that we acquired from Guardicore. This is pretty typical what we do with our acquisitions. They'll be primarily in an overlay function. You know, it's a little bit different of a sale, very similar to some of our enterprise sales, and we just will build out that team a bit. You know, it'll probably take maybe a year or so as the reps start to introduce Guardicore into their accounts, that they begin to get comfortable with selling Guardicore. It's been our typical model.
I think we've acquired a great team from Guardicore and, you know, we just combine that with our existing enterprise sales team. As far as channels go, we did pick up a few channel partners as a result of Guardicore, and we're still actively out recruiting more and more channel partners.
In terms of the developer focus question, you know, we've done a lot of work to make our platform be very accessible to developers. A lot of effort there and strong progress. In fact, on a daily basis, we're now spinning up about 5 billion applications on EdgeWorkers, and that's every day. Strong adoption of our capabilities in terms of edge computing.
Your next question comes from
Operator, next question.
Yes.
Thank you.
Your next question comes to the line of Sterling Auty from JPMorgan. Your line is now open.
Yeah, thanks. Hi, guys. You gave us the security growth on a constant currency, but can you give us a sense of what it was on an organic constant currency basis? Tom, you highlighted a number of different areas, the strength in DDoS, et cetera. What was kind of the tip of the spear that drove the growth this quarter in particular?
Yeah. Hey, Sterling, this is Ed. The organic security growth in constant currency would be about 22%, so Asavie would be added about 3 points of growth. Tom, you wanna take the other part?
Yeah. The strength was really across all of our product categories. You know, all of them growing at close to 20% or more. Infrastructure doing well, App & API Protector product, you know, well into, you know, close to 30% growth and access, the best of all. Of course, that'll get a lot stronger now with Guardicore and the ransomware solution. I just it's across the board in security.
It's great. Maybe one real quick one. Given the contribution you're expecting from Guardicore in Q4, does that mean that the run rate in terms of what the contribution in 2022 might actually be better than what you thought at the time of the acquisition?
Yeah. Hey, Sterling. Two points on that. Yes, I think we should see better contribution from Guardicore. Also, we've been off to a pretty good start here in the first couple of weeks since we've closed the acquisition. They finished very strong. I was very impressed to see several multi-million-dollar deals in several different verticals across the different geos. We saw a couple in the U.S., couple in EMEA and APJ. We saw deals in transportation, which isn't really a huge vertical for Akamai, as well as other verticals we're strong in, like insurance and finance. Off to a pretty good start, pretty optimistic so far, and I do think they'll contribute a bit more next year.
We'll give you a full guidance, you know, on our next call for next year, but so far off to a pretty good start.
Excellent. Thank you.
Your next question comes to the line of Colby Synesael from Cowen and Company. Your line's now open.
Hi, this is Michael on for Colby. Two questions if I may. First, you know, as you think about the incremental security offerings that could make sense to add via M&A moving forward, you know, what comes to mind? Second, you know, what are you seeing from the customer verticals that have been more heavily impacted by the pandemic as we go into the holiday season? Thank you.
Yeah. We continue to look and invest in new capabilities in security, both organically and through M&A. As we talked about, Page Integrity Manager released in the last year, very exciting technology. You know, going forward, we have Account Protector. There's a lot of customer interest there. And then early next year, Audience Hijacking Protector. I think that's, you know, a lot of customers have asked for that, and that stops malware or plug-ins from stealing or hijacking their audience right before the point of sale or the transaction is executed. Obviously, you know, in the access segment, I think that's a huge area of future growth. Really excited about the Guardicore acquisition. You know, that combines very nicely with our zero trust solutions.
It combines with Enterprise Application Access to give you the full combination of north, south, east, west. I think we'll be compelling in the market. We're continuing to invest across the board and of course, with the existing solutions, you know, that we continually work on those to add features, stay ahead of the new attack vectors. It's not just like you build a Web Application Firewall, you're constantly adding new capabilities to it to stay ahead of the attackers to keep our customers safe.
Yeah, on your second question. On the second question was around the verticals that were impacted, and if you recall, we called out commerce and travel. I'd say in travel, we're starting to see a bit of improvement there, starting to see traffic pick up a little bit. As a reminder, that's about 4% of our total revenue, so doesn't have a huge impact in terms of what we're seeing as far as an improvement, but it's good to see that that's starting to pick up a little bit. Commerce, I would say, is pretty mixed. We're seeing good strength in security. Still seeing some pressure, especially in the U.S. commerce vertical. That's a much bigger vertical. That's around 15% of total revenue.
We're not quite out of the woods yet with commerce, again, especially in the U.S. That's the area that we're probably seeing the most weakness, and that's still persisting from the pandemic.
Perfect. Thank you.
Your next question comes to the line of Keith Weiss from Morgan Stanley. Your line is now open.
Excellent. Thank you guys for taking the question. Two kind of areas that I was hoping to dig into. Can you talk to the disparity in growth between the U.S. and international? I thought it had more to do historically with sort of platform customers in the U.S. underperforming, but now the platform customers are actually doing really well and growing pretty well. I kinda lost the thread on why the U.S. is still underperforming international regions. Then a second question on sort of the operating margin side of the equation. Any kind of guidelines you could give us in how we should think about calendar 2022? Are there kind of...
A lot of companies are talking to us about rehydration, if you will, maybe more spending on travel and people coming back to the office and marketing events ramping back up. On the flip side of the equation, you've been kind of underspending on CapEx versus the original target, and that's coming down as a percentage of revenue, so perhaps there's some gross margin benefit that you could see in calendar 2022 to offset that. Any kind of sense you could give us on how to start thinking about calendar 2022 margins?
Sure. I'll start with the second part on margin. Yeah, you're correct. I mean, next year we'll be expecting that we should start traveling again. There'll be a little bit more OpEx there. You're right to call out CapEx as, you know, I think the team's doing a fantastic job on a lot of CapEx efficiency projects that we've got going with both software and hardware, being able to drive that down. We'd expect that CapEx to be at a, you know, back to those normal levels that we've seen, maybe even a touch lower, so that impacts your depreciation. It takes a while for that to flow through the model, so you won't get a ton of benefit of that right away, but certainly down the road you will.
I'd given some prior guidance when we had the Guardicore call about operating in the 29%-30% range for next year, and then hopefully getting back or we will get back to over 30% in 2023. Obviously we'll update you. I had mentioned earlier to Sterling that, you know, Guardicore's contribution will probably be a bit better than what we said earlier on. I don't have a number to call out yet, so that'll obviously help out the operating margins a touch there. You asked about U.S. and international and the disparity between the two. I'd sort of flip it around and say that it's not so much the U.S. being weak, but really just strong international growth. I mean, U.S. is kinda low single digit.
I mentioned on the previous question, that's where we're having the most trouble with our U.S. commerce vertical, which is a pretty significant vertical in the U.S. We also have a lot of large media customers that are in the U.S., and that's where you tend to see you know, more of the splitting of traffic and pricing pressure. Those things combined you know, sort of put a little bit of pressure in terms of the growth rate in the U.S. Really, the strength outside the U.S. is something that I think is a significant advantage for us. We made a lot of investments both in the network and the sales teams, et cetera, and we've been able to drive pretty significant growth.
Very happy with what I'm seeing in terms of participation as far as, you know, strong growth in countries like Korea, Spain, Brazil, Mexico, Hong Kong, Singapore, Taiwan. I mean, across the board, we're seeing very strong growth. Latin America in particular has been very strong. We made an acquisition there a couple years ago. Starting to get some good scale out of that. You know, a little bit of a mixed picture in the U.S. with some challenges in commerce. Really I look at it as just very strong international presence and growth.
Got it. I mean, should the takeaway be that, like if we just looked at the Security side of the equation, the growth in U.S. and international would be more even, on the Security side of the equation than it would on the Edge tech side?
Yeah. I think that's a good way to look at it, Keith. I mean, if I look at, you know, the web performance, especially in commerce, that's where the primary challenge is right now.
Mm-hmm.
If I look at security, it's, you know, obviously the U.S. was the first to adopt. We're still seeing very, very strong growth. You know, as a matter of fact, now 67% of our customers are buying one security product, 34% are buying two. You know, to sort of put that into perspective, in a year we've gone up 6 points in terms of security adoption of the customer base. That's adding over 600 customers. So we're seeing, you know, good broad-based strength in security, both here in the U.S. and also internationally. I think you're thinking about it in the right way in terms of, you know, having strong security growth in both regions.
Got it. Excellent. That's super helpful. Thank you, guys.
Your next question comes to the line of James Breen from William Blair. The line's now open.
Thanks for taking the question. Just on the cash flow side, it seemed like a particularly strong quarter, given some of the improvements you've had in the network and just in expense control in general. You know, how should we think about that cash flow going forward? Is this a particularly strong quarter and it could tend to drip down over time, or is it gonna be lumpy, or we had a sort of a new run rate in terms of cash generation? Thanks.
Yeah. Great question, Jim. Q1 tends to be the lower quarter from a cash flow perspective just because of working capital, it's when you pay your bonuses. You know, I think if you peg your CapEx to that sort of 15% range, you know, you're looking at pretty significant improvements. I think if you use that as your guide, kind of working off the operating margins we gave you and think about Q1 as probably being a low point as you're modeling out your free cash flow.
Yeah, very strong free cash flow generation this quarter for sure.
Great. Thanks. Just one other one. As you look at the revenue growth, excluding the platform customers, you know, the platform customers were down about $3 million sequentially. You know, is there a range now where you feel like in this sort of low 60s range is where that revenue's gonna hover for those companies, you know, given the amount of growth you've seen in the last kind of 12-18 months from that?
Yeah. I think that's probably not a bad place to peg it, Jim. I mean, the Q4 always tends to be a bit of a stronger quarter in that vertical. There's a little bit of seasonality there. You always have renewals, so whenever you have a renewal, you'll see it pull back $2 million depending on the timing and that sort of stuff. I think in the low 60s is probably a decent place to peg it.
Terrific. Thank you.
Your next question comes to the line of Frank Louthan from Raymond James. Your line's now open.
Yeah. Great. Just wanted to talk a little bit about the buybacks. You said you'd opportunistically use that to take advantage of the market valuation. You know, what level seem appropriate here? That's kinda the first question, then I've got a follow-up.
So primarily we've used the equity buyback to offset the equity dilution from employee grants. From time to time, we do buy back.
Additional shares, and we've seen that over the years. We use an approach such that as the stock price declines, we will buy back more. You know, I do feel that in this market, you know, Akamai has a very strong presence both in CDN and security. Our security business growing at 25% on a very big number. I do feel that Akamai is worth a lot more in this market. You may see us buy back additional shares, especially depending on how the stock price fluctuates.
All right, great. Then, you know, you've done a good job, you know, adding together some M&A for the security on the security side. Any other tools that you think you need to make yourself more competitive in the market, or you feel like you've got kinda the right mix here to for that product set?
Yeah, we're always looking at new capabilities, as I mentioned. You know, of course, the attackers are always innovating with new forms of attack. You know, I am very excited about the Guardicore acquisition, and I think it really does, you know, fill out and complete our access story, our ability to stop ransomware and malware. As I mentioned, we already have capabilities that prevent the malware from getting in. You know, Enterprise Application Access in particular governs what employees can touch and access, and even then it has to come through Akamai's application firewall, so we're making sure that malware doesn't come in. We also have multi-factor authentication, which, you know, makes sure that the employee is who they say they are. Now with Guardicore, we stop the spread of the malware if it does get in.
There are a lot of ways into the enterprise today. It is really despite all the defenses you try to put in place, you know, somebody, for example, in the Colonial Pipeline case, a password or credential gets out there. Now we still have ways of catching that somebody is using a stolen credential, but malware does get in still. The real key there is stopping the spread, and that's what Guardicore does. Now I think we've it's really nice because you stop the ransomware with Guardicore, but we've got the whole package and whole solution now. I think that's really unique in the marketplace and very exciting.
All right, great. Thank you very much.
Your next question comes to the line of Amit Daryanani from Evercore. Your line's open.
Yep, thanks a lot and good evening, everyone. I have two questions as well. You know, the first one I was hoping if you could talk about, you know, as I look at the midpoint of your guide for December, is there a way to think about how are you thinking about seasonality in edge and security? The part I'm really trying to get to is the security numbers may imply a much more severe deceleration than what people are modeling. I'd just love to understand how are you assuming those two segments stacking up in the December quarter?
Yeah, sure. I'll take that. We'll start with the Edge. Obviously, Edge is quite a busy quarter in Q4. As I talked about, you have seasonality from e-commerce. I think it's obviously a tougher quarter to call here with, you know, some supply chain disruptions and things like that. Does that drive more or less internet traffic, and what does that holiday season look like? Typically a very strong media quarter where you see new devices, consoles, et cetera, coming online. You also have a lot of sporting events in Q4, back to school. You've got lots of game releases. It can be a pretty robust season for us and obviously challenging to call. I've kinda looked at the events calendar.
It's pretty full, so, you know, provided we see some good traffic, you can see good upside. We've delivered that in the last couple of years. You know, in terms of security, it's not as seasonal, certainly. There are some bundles we have where traffic can impact that a bit. You know, I think to take our security guidance, we've been pretty conservative in the way that we've approached security, and we've been over-delivering every quarter. I think, you know, we've had obviously Guardicore is off to a good start, so I wouldn't imply that as a seasonal downtick or anything like that in our security growth.
Got it. Then, you know, if I could follow up, the CapEx number for September quarter and really for December as well, I mean, CapEx as a percent of sales, I think it would be 14%-15% for the back half of the year versus 19%-20% for the last several quarters prior to that. I'm curious, is CapEx coming down because you feel like there's enough, you know, capacity you have out there and you can scale it lower, or is it more that you just can't get your hands on the supply chain and the products you need to drive CapEx? I'm just trying to understand what's taking CapEx lower, and then how do I think about this as we go into 2022?
Yeah. I would say it's good execution. If anything with the supply chain, we're not seeing supply chain disruptions, in terms of the fact that actually, if you remember a few calls ago, we talked about in the pandemic, we took CapEx up, and we were pretty cautious in terms of making sure that we had plenty of extra capacity available, for you know, if we see you know, the pandemic continue and see traffic grow, et cetera. We leaned in. We built up our inventory a bit. We bought a lot of you know, small equipment so that we're not concerned right now anyway with the supply chain. I'd say that's part of what's driving it, is we built out ahead of demand. We're pretty smart in the way we did that.
Also, I mentioned there's a number of CapEx efficiencies that Adam and his team are working on, not only just software, but network design, deployment optimization, looking at different hardware improvements, and just continuing to drive a big focus on lowering our need for CapEx. Also keep in mind we have great relationships with the networks and ISPs, so in terms of doing you know, optimizations inside of their networks, we're able to do that as well. I'd say it's really you know, great execution on the team's part, and you know, CapEx has come down pretty significantly. You see that in our free cash flow results.
I'm sorry. Does that sustain next year, like this mid-teens CapEx as a percent of sales? Is that the right way to model this out?
Yeah. I mean, right now, you know, unless you see another pandemic or some major event, and we see, you know, some crazy unexpected traffic growth, yeah, I think it's a sustainable number, certainly going into next year. I don't wanna get into giving guidance, but I think that, you know, I've talked about in the past that we'd be getting back to this level and, you know, we're actually operating a little bit better than that.
Perfect. Thank you.
Your next question comes to the line of Rishi Jaluria from RBC. Your line is now open.
Hey, guys. Thanks so much for taking my questions and nice to see security growth, you know, hold up and actually accelerate this quarter. Two questions. First, I wanted to go a little bit deeper on the supply chain issues. You know, I appreciate you've obviously over invested capacity with the OTT launches and the pandemic last year. So you seem pretty well insulated from the rising costs. But at what point, you know, that this continues dragging out, does it begin to become a worry and, you know, you might have to overspend in order to keep capacity and not have to turn away business?
Maybe related to that, as we think about, you know, the environment heading into Q4, how do we expect that to shake out, especially given Q4 is such a, you know, traditionally such a strong commerce season? You know, a lot of companies are telling us they're not gonna be able to meet demand, you know, especially when it comes to electronic goods. Is that a worry that you have? Maybe how are you thinking about embedding that in your guidance? Thank you.
I'll take the second part first. That's why we gave a pretty wide range. I just mentioned on the last question that it's hard to predict what the commerce season looks like. Obviously, when you're in the business of delivering internet traffic, one model could suggest that while shelves are not stocked, people are doing more surfing to find things. Another model would suggest that there's not as much shopping and people are giving cash and gift cards. Hard to tell, but we did put out a pretty big range there. Also keep in mind that a lot of our commerce customers, about half of our commerce customers have taken what we call our Zero Overage. You've kind of flattened out that bursting.
The burst in commerce is not as big of an impact. Q4 still has an impact. In terms of the device cycle, you know, that's an interesting one. You know, we do expect, and we've seen over the last several years, especially in the last couple of weeks of the year, as new devices come online, there's a lot of firmware updates and things like that, and I still expect to see that. But there's, you know, other things that are not as dependent on that, for example, gaming releases, new video content that comes out. If you don't have a new machine, you're watching it on your old machine. I still think that we'll have a pretty big media quarter for sure.
You know, that's why I've given a pretty wide range to try to take those things into consideration. On your supply chain question, you had asked about when does this become a problem? You know, it's funny, I ask the same questions to my team as we go through our CapEx build-out. We've done a nice job of building out several quarters worth of inventory here and, you know, we've diversified our supply chain and, the team's done a good job of ensuring that we're not seeing any significant increase in pricing or anything like that. A little bit on the freight side, but it's not really material, and I think that should start to work itself out.
You know, if we do see a, you know, another massive growth in traffic, maybe we start to run into some problems, but so far so good. Like I said, the team did a really good job preparing, you know, not expecting this type of a disruption in the supply chain, but expecting that the result from the pandemic would last a lot longer. We did some scenario planning, so we're in pretty good shape at the moment.
All right. That's really helpful. Thank you so much.
Your next question comes from the line of Alex Henderson from Needham. Your line is now open.
Thanks. Looking at the guidance and the commentary, it does sound like your security business is expected to decelerate to below 20% growth in the fourth quarter. Certainly if I add in some of the inorganic, that would imply even lower growth. Is it reasonable to think that the security business can sustain a 20% growth rate organically in 2022, or is that too aggressive of an expectation for a $1.3 billion business?
Yeah. I think one thing to keep in mind, Alex, is you've got the anniversary of Asavie. Your growth rate, you know, laps in Q4 for Asavie, and then we also see that in Guardicore. You know, we've said in the when we did our analyst day that we expected to be able to grow 20% CAGR, three to five years, with acquisitions being part of the strategy. You can see that, you know, the Guardicore acquisition with the prior guide is, you know, only a couple of points of growth. You know, we obviously did much better this year than we expected going into the year. Security has, you know, overperformed every single quarter. We still feel pretty comfortable with our 20% growth rate as we talked about.
As you know, as a matter of fact, coming out of this year, we're doing a bit better than that. You know, I think if you're taking the super low end of the range, maybe you could come up with that formula. You know, we're expecting, you know, pretty solid growth here with security in Q4.
Yeah. Let me just add, you know, our strategy in security is to combine organic development with you know, intelligent and timely acquisitions, and we'll continue to do that. Of course, when you buy a company after a year, its growth becomes organic, and it's no longer counted as you know, an acquisition growth per se. I think we've had a really great track record of doing that, you know, in security, going back all the way to the Prolexic acquisition in 2014. As I mentioned, I think Guardicore is you know, fundamentally like that in terms of really transforming our enterprise security business, just like Prolexic transformed our DDoS business, which of course today is very, very successful. We're the market leader by far.
Our goal is to do that on the enterprise security side for things like stopping ransomware and stopping malware. As Ed said, as we, you know, continue to wanna grow our security business over the longer term at 20%+, that will include acquisitions. I think acquisitions are a good thing. It gives you a jump-start, you know, on technology in an important area. You know, Guardicore has been working for a long time to develop, you know, their micro-segmentation approach. I believe it is market-leading in what they do. They're the best folks out there.
Now we have the benefit of all of the years of effort that they put into that at a perfect time, 'cause a lot of companies are rightly worried about stopping ransomware, and now Akamai's in a position to help them do that. Of course, it fits with a lot of our organic development, technology around EAA. It's an ideal combination. We'll continue to do both and working hard to continue our security growth at 20%+.
Okay, I get it. Thanks. That's helpful. Can you talk a little bit about, you know, the pricing environment, whether there's been any change in competitive landscape? Have you seen more competition or less competition? How should we think about the environment? I think we're also seeing, you know, enterprises spending more this year. Do you think that sustains into 2022, given the first half spike in attacks caused a flurry of spending intentions?
I think the competitive environment is very similar to what it's been in the past. It is a very competitive environment, you know, across the board from cloud giants who are also our largest customers all the way down to startups. Obviously CDN is a mature environment competitively, and so I don't see there's any fundamental change there. Security is really a great environment for us. You know, we're the market leader by far in the core areas of defending and protecting websites, applications, and APIs, the leader by far in DDoS prevention, and those are areas that have a lot of attacks taking place.
Now sort of the new category for us, where we'll encounter new competition 'cause we're moving into that space in a big way, would be enterprise security. We already have a very strong access solution there, and now we have what we believe is the best solution to stop ransomware with micro-segmentation. By adding that to Akamai, we now have a new set of competitors there because we're entering their space, and we think there's a lot of potential gain for Akamai there and ability to help major enterprises.
Great. Thank you very much.
Your last question comes to the line of Brandon Nispel from KeyBanc Capital Markets. Your line's now open.
Awesome. Thank you for taking the question. Could you unpack the growth in the Edge Technology Group, please? What was the growth in the quarter for Edge Applications, and what does that imply for the growth in the Edge Delivery business? How do you expect these two segments within that larger group to trend exiting the year? Thanks.
Brandon, we're not gonna break out Edge apps every quarter. You know, we talked about it last time growing at over 30%. You know, we think that business can continue to sustain that. I think we'll exit the year on a run rate, you know, over $200 million, which is a pretty good, healthy growth rate there. Again, we're not breaking out the Edge Delivery business this quarter. We'll do it at the end of the year.
If I could just follow up on that. When you back out some of the one-time items that are affecting comparability in the Edge Technology Group, specifically, I think the India app ban you're still lapping. Is that business growing, and what's gonna cause that business to return to growth next year? Thanks.
Yeah. It's obviously just a tougher compare. This is the first quarter that we don't have that compare, and you saw that we were roughly flat in terms of total Edge Tech. I think, you know, as we get into next year, it's an easier compare. You know, I think we're comfortable with our longer term growth in the low single digits for the Edge business over time. Obviously, you know, with the Edge Applications business much faster growing, as that becomes more material, that could change the growth rate. But I think it's just continued execution and traffic growth going into next year on a much easier compare. I think you'll start to see a bit of the growth rate pick up a little bit there.
Okay, thank you, everyone. In closing, we'll be presenting at a number of investor conferences and roadshows throughout the rest of the fourth quarter, and details of these can be found in the Investor Relations section of akamai.com. We appreciate you joining us, and all of us here at Akamai wish continued good health to you and yours, and have a great evening. Thank you.
This concludes today's conference call. Thank you for participating, and have a wonderful day. You may all disconnect.