Thank you all for joining us. I'm gonna begin with the key operating dynamics of the quarter, and obviously talk a little bit about how we're advancing our strategy to drive sustainable long-term growth. In our first quarter, we delivered double-digit growth in non-GAAP earnings per share and adjusted free cash flow, with revenue growth at 5%. Subscription revenue remained a key strength driven by strong demand across our emerging technologies, which actually generated 45% growth in calculated billings led by email security, CTEM, and SASE. At the same time, we do see a decrease in Appliance refresh projects that resulted in lower than expected product revenues.
As we discussed in our last earnings call, during the second half of 2025, we conducted a comprehensive go-to-market assessment with the objective of accelerating both new logo acquisition and increasing wallet share in large enterprise accounts in order to enable the successful execution of a multi-pillar platform strategy. Based on this, we implemented changes to our go-to-market model to align with these goals. The transition to the new model did create short-term disruption to the rhythm of our sales execution and primarily affects our Appliances business. While we're confident that the changes made are setting this up for success in the mid and long term, we do see a short-term impact on our business that will negatively affect our 2026 revenue projections.
We believe these headwinds are transitory, and they reflect a deliberate reset to position our business for improved execution and scalability. We're already seeing that the current pipeline trends and ongoing customer engagements, and our plans to further invest in our firewall business, make us optimistic about the future growth trajectory. Beyond that, our strategy continues to be anchored around our four pillar approach, which we believe is well aligned with the evolving security requirements of enterprise, particularly as AI adoption expands the threat landscape. In support of our go-to-market execution, we're strengthening our leadership team with 4 key appointments. First, Sherif Seddik has been named Chief Revenue Officer and will lead our go-to-market organization. Sherif has successfully led our international sales business over the past three years.
He brings more than three decades of global sales leadership experience. He'll be replacing Itai Greenberg . I want to take this opportunity to thank Itai for his continued support during my first year and for his leadership in the go-to-market changes. Beyond that, Yochai Corem, who has led our CTEM offering since the acquisition of Cyberint and has driven 96% year-over-year ARR growth, will join the leadership team. You know that as organizations operate in this increasingly agentic world, exposure management is becoming mission-critical because it enables security teams to rapidly identify emerging threat and the most important part is materially accelerate their remediation. I think we have an advantage here, and I'm happy to welcome Yochai.
Alongside that, to lead our AI pillar, I'm happy to say that Adam Ely has joined as General Manager of AI security and will also join the leadership team. Adam brings a deep experience, you know, at the intersection of cybersecurity and large-scale enterprise security operations, because in his previous roles, he was a CISO at Fidelity, deputy CISO at Walmart, but he's also a founder of Bluebox Security . I think Adam adds really a proven operator's perspective, which is so essential in this time, he'll focus on building the platform, our AI security platform, to scale with the speed, the rigor, and a strong commercial pipeline. Lastly, Rupal Hollenbeck is appointed VP of global marketing. He'll replace Brett Theiss, who we wish well in his future endeavors.
Beyond that, look, you're all aware, AI is a watershed moment for the security industry. When you look at the emergence of these frontier AI models, including Mythos and GPT-class, they're driving two structural shifts in cybersecurity. First one is that the barrier to sophisticated cyberattacks is literally collapsing, because AI is democratizing capabilities that were once exclusive to nation state and some very large elite, quote-unquote, "criminal organizations." This is exposing a far broader set of enterprises to material risk. That's number one. Number two, cyberattacks are undergoing structural industrialization. The agentic AI enables threat actors to continually scan global infrastructure, they're generating a continuous flow of novel attack techniques. Manual operations are giving way to automated attack pipelines, you know, this is what we call at Check Point the AI attack factories.
When you look at the convergence of these two forces, it really creates a different threat environment. Larger attack population that is executing more sophisticated campaigns with greater speed and volume. The time to exploit is shrinking dramatically. We believe, I believe, that this is directly validating our ethos of prevention first, which we're second to none in the industry, in my opinion. Beyond that, at Check Point, we're not waiting for this threat environment to materialize. Our response is ready and active. It's structured, of course, across our four-pillar framework: the security for AI, the network through our hybrid mesh, CTEM, and workspace security. During this quarter, we introduced solutions to secure enterprise AI transformation.
As an example, we launched the AI Defense Plane, which is designed to secure the agentic enterprises across employee AI usage, the applications, and the agents that both of these use, the people and the applications. Beyond that, we introduced the AI Factory Security Blueprint. It's integrated with the NVIDIA GPU server, sitting on the server itself, this provides end-to-end protection for AI infrastructure, and we're very bullish about this. Most recently, we also announced our partnership with Google Cloud. We're integrating this AI Defense Plane with Gemini Enterprise Agent Platform, and this can deliver real-time runtime protection at scale. We also delivered AI-driven exposure management, enabling customers to close the remediation gap through, one, improved intelligence, then the risk prioritization, and finally, safe remediation, which is critical, the time to remediate, in organizations today.
Finally, we launched a secure AI advisory service, through to help enterprise govern, deploy, and ultimately scale AI, with security and doing so responsibly. To close, my opening remarks, while we're experiencing near-term headwinds in our appliance business and adjusting our annual revenue guidance, we remain confident in our ability to gain market share in this expanding security market. The emerging technologies continue to perform strongly and position Check Point, at a really good place to secure this rapidly growing enterprise attack surface driven by AI adoption.
We believe that our differentiated strategy, our core capabilities, our strong financial profile with its industry-leading profitability, and at the end of the day, a disciplined execution over time position us to really benefit from the accelerating demand for secure enterprise-grade AI, which is transforming organizations at scale.
Before I take the questions, with that, I'll turn to Roei to give you some of the financials.
Thank you, Nadav. One moment. Can you see my screen? Great. Thank you, Nadav, and thank you everyone for joining the call. As Nadav mentioned, the first quarter was a solid quarter with 5% growth in revenues, driven by 11% growth in our subscription revenues. Our total revenues reached $668 million and were $2 million below the midpoint of our projection as a result of lower revenues from firewall appliances that impacted our product revenues. When we are looking around subscription revenues, they grew by 11% to $323 million and were at the midpoint of our projections. Our adjusted free cash flow was very strong and reached $457 million, $70 million above the midpoint of our projection, and grew by 11%.
Our non-GAAP EPS was $2.50 and was exceeded our guidance with 13% growth year over year. As mentioned, we had 5% growth in revenues while our deferred revenues grew by 8% to $2.06 billion. Our calculated billing totaled to $548 million, reflecting a 1% decline year over year, while our current calculated billing grew by 2%. Our remaining performance obligation grew by 7% and reached $2.592 billion. As we, as Nadav indicated, earlier in the call, we had lower than expected product revenues, mainly as a result of a disruption affected by the changes we made in the go-to-market organization.
As we are looking into the second quarter, we do see this disruption still affecting our firewall appliances revenues. Based on the funnel that we see, we expect to see an improvement in the second half of the year. It is important to note that our renewal business continued to be stable. Our firewall subscription ARRs continued to grow year-over-year. We are looking on our subscription revenue, we do see a trajectory for re-acceleration. We do expect to see acceleration in our subscription revenues in the second quarter and for the full year of 2026, driven by strong demand by emerging pillars, mainly by email security, CTEM, and SASE. As indicated, our total subscription business continued to be strong.
We continue to experience strong demand for emerging product, which remains the primary driver for our revenue growth. In Q1, our email security, SASE, and ERM in total exceeded 40% growth in ARR and over 45% in calculated billings year-over-year. It is important to note that although the revenues are still not significant for the total business, we see a significant growing funnel for our AI security offering, and that's together with the email security, CTEM, and SASE expect to drive the subscription revenue growth in the next few quarters. When we are looking at the revenues by geography, 46% of our revenues coming from EMEA, which had 6% growth year-over-year.
42% of the revenues came from America and delivered 4% growth year-over-year. The remaining 12% came from Asia Pacific that had 2% growth year-over-year. When we are looking on the P&L for this quarter, our gross profit increased from $564 million to $586 million, representing a gross margin of 88%. Our operating expenses, excluding R&D grants, increased by 14%, while on constant currency basis, our OpEx increased by 12%. Q1 results include approximately $27 million of benefit from R&D grants to be received out of the new Israeli incentive program law, which was ratified during the period. That's reflecting the associated impact in our financial results. Our operating expenses net of R&D grants were $321 million and increased by 5% year-over-year.
When we're looking at these grants, we do expect to have an approximately benefit for the total year of $100 million on our operating income reflecting the new law that was just approved or just finalized. The increase in our OpEx is primarily as a result of our increase in our workforce, as a result of investment in our AI security, and investment in sales and marketing program. Looking on our non-GAAP operating income, it continues to be strong at $265 million or 40% operating margin. Our non-GAAP net income increased by 8% and reached $265 million, while our GAAP net income reached $192 million, similar to last year. Our non-GAAP EPS grew by 13% and reached $2.50, while our GAAP EPS was $1.81, representing 5% increase.
Moving into our cash flow and cash position. Our cash balances as of the end of the quarter, together with market-based securities and short-term deposits, reached $4.4 billion. During February, we completed the acquisition of Cyata and Cyclops for approximately $92 million of net cash consideration. Our adjusted free cash flow increased by 11% and reached $457 million. In addition, we continued our buyback program and purchased 1.9 million shares for a total of $325 million at an average price of $170 per share. To summarize, strong double-digit growth, non-GAAP EPS and adjusted free cash flow. We do see continued strong demand for emerging technologies, SASE, email security, CTEM. From the other end, we do see in the near term lower new business from firewall that affected our revenues.
One, I want to go into the guidance for the second quarter and for the full year. For the second quarter, our total revenues are expected to be between $660 million-$690 million. Our subscription revenues expected to be between $328 million-$338 million, and non-GAAP EPS is between $2.40-$2.50, while our GAAP EPS expected to be around $0.70 less. While our adjusted free cash flow expected to be between $145 million-$175 million. Regarding the cash flow, the free cash flow, important to say that there are some payments, significant payments in that move from Q3 to Q2, again, that's mostly shifting from Q2 to Q3. When we are looking on the full year guidance, as Nadav indicated, we are adjusting our revenues guidance, our total revenues guidance, for the full year. The updated guidance is between $2.770 billion-$2.850 billion.
That's in a reflection of expected lower revenues from firewall appliances mainly in the second quarter. Our subscription revenues, we are not changing. We do see strong demand for our emerging product, and we hope to finish in the upper end of the range, but we are keeping the same range for the full year. Same thing for non-GAAP EPS. We are not changing our non-GAAP EPS, expected to be between $10.05-$10.85. GAAP EPS gonna be slightly higher, again, mainly because lower share count and slightly higher acquisition-related costs. Our adjusted free cash flow, we are not updating the guidance, same as we gave between $1.15 billion to $1.25 billion.
I'll stop sharing. Kip? You're on mute, Kip. Kip? Maybe it's better that you're on mute, Kip? [audio distortion]
Unmute. All right.
Yeah.
Sorry about that, guys. Having a little bit of technical difficulty. Starting off today's Q&A is going to be Brian Essex from J.P. Morgan, followed by Rob Owens of Piper Sandler.
Great. Thanks, Kip. Good morning, everyone, thank you for taking the question. Nadav, I wanted to dig into product revenue performance. We'll take the easy question. Was macro or customer decisions to sweat assets not a factor at all? You know, if not, can you offer a little more color around the depth of the go-to-market changes? You know, where was the friction in the process most apparent? Where did the system break down? What gives you confidence this is just a near-term issue?
Thanks. Look, I don't think the macro is the issue here. When you look at our, the changes that we've made to our go-to-market, they're significant. You know, it's optimizing accounts to account managers. It's, you know, doubling down on our marketing, doubling down on our channels. But it did create a short-term headwind in terms of execution as many of our people changed their role or changed accounts. I see this as the main driver or the main headwind that we're seeing in terms of the firewall business. You know, I don't think this is. We don't see a macro problem. We're actually already seeing that the engagement with our customers and the funnel going back to normal.
We're optimistic that this is a sort of a blip. It does take a little time to sort of get the motion back and everybody in their seat, et cetera. For the long run, we believe this is the, this is the right thing to do, and we're gonna continue to invest. This is just on the, you know, on the, on the workforce. Leadership changes, in America, leadership changes in other areas. There's a, there's a process here that we're going through. I think we're at the tail end of the disruption and very optimistic about the future.
At the same time, w hen I actually look at the demand side, we're seeing different areas growing. As an example, we're very bullish on new AI data centers, where I think we have a very unique capability. For the longer term, that's how we see the market, and we're optimistic.
All right. It's helpful color. Thanks. We'll keep Kip happy and keep it to one question.
Thanks, Brian. Next up is Rob Owens from Piper Sandler, followed by Joe Gallo from Jefferies.
Great. Thank you for taking my question, and good morning here from the West Coast. Obviously, the world's been changing quickly over the last six weeks. I'd love to understand your perception relative to what's happening and how that's influencing Check Point's business. In line with that, it feels like you're losing momentum at a critical time for cyber here. How do you ensure that this doesn't lead to longer term share losses as customers are having to make decisions in the near term to protect against these next generation threats?
Well, honestly, I actually think that we're gaining, not losing, when you look at the big picture, right? You know, take Mythos as an example, right? We think that, as I said, this is going to create a democratization, industrialization, and change the nature of the business. I actually believe that we're really well-positioned to answer that. At the same time, when you look at the relevant pillars, CTEM is growing, has grown 96%. Email, which we are one of the best in class in the industry and ready for this AI revolution, is growing over 40%, et cetera. That's one thing. The other thing is when you look at the fundamentals of the change in cybersecurity, I actually think that our ethos of prevention first as an example.
If you look at the latest reports by NSS and Miercom, again, once again, we're at 99.9% ability to stop attacks of known CVEs. This was always important. I think now it's becoming really critical because that's exactly the change that's happening. You're gonna have to be able to block as fast as possible, or everything that is possible, and then you're gonna have to remediate extremely fast. I think from both sides of the equation, we actually have an advantage here.
Next up is Joseph Gallo from Jefferies, followed by Adam Tindle of Raymond James.
Awesome. Thanks for the question. I know you talked about the impact to appliance execution, but I think the most exciting part of this story is the subscription growth and the potential for acceleration there. If we look at current billings and you take out product, that only grew 3% year-over-year in 1Q. Just you're guiding to 12% subscription growth and acceleration in the back half. Maybe just walk us through a little bit more about the confidence in that, and then just any broader commentary on how we should think about billings going forward. Thanks.
I'll take it. You're right in terms of current billings excluding product, but that takes into account also, like, maintenance and software and maintenance updates, and actually it's pretty flattish right now. If you're excluding that, actually the growth of subscription is much higher, subscription billings. We do see, by the way, we see the funnel even for the second quarter and also, and mainly for the second half of the year. We see very strong demand for our subscription packages, for our subscription offering, if it's email, SASE, CTEM we discussed, and also AI security. The numbers are still not significant in terms of bookings for AI security, but we see very significant funnel that was created just in the last few weeks. We see the enthusiasm about it.
We have a new leader there, and now they're managing this business, so definitely we feel positive about the subscription also for the next few quarters to really accelerate.
Thank you.
Next up is Adam Tindle from Raymond James, followed by Shaul Eyal of TD Cowen.
Okay. Thanks, Kip. Good morning, Nadav. I just wanted to take a step back. There's kind of two major things that we're having to digest here on this call. The first one, I wanna understand what exactly is happening to product revenue that is causing this revision. Is there changes to terms with distributors? Is there issues with supplies and shipping? What exactly is changing and happening that's causing this mechanically? The second thing that we're digesting here is the go-to-market changes that you're implementing. I wonder, you know, we've gone through this before with Check Point in the past, a number of changes to go-to-market leadership.
When you look at these, if you could maybe compare and contrast some of the things that have been done in the past to this time, what you've learned and what might be different, with these, go-to-market changes. Thanks.
I can start on the first one, and Nadav will take the second.
Sure.
Yeah. On the and in terms of the product, why it's mainly affected the product. We did this, we did changes in the go-to-market organization. Part of these changes were a lot of changes for assignments for account managers that worked on large enterprise and enterprises that moves from accounts to other accounts. This had some kind of. Again, it's something that was expected, but that had more disruption that we expected on the business, mainly on the new business. On the new business, on the, I remind you that the funnel for refresh projects for new business on firewall takes slightly bit more time than the sales cycle is longer than a sales cycle for selling CTEM email or other products, or this kind of product.
For firewall, it usually takes longer, and we see disruption in funnel creation mainly in Q1 that affecting mainly some of it in Q1, but mainly in the second quarter. Therefore we see the funnel starting, we see a very nice improvement in the last few weeks after all people are on role, at role and the relevant roles, and they are starting to work on their accounts. We're starting to see the funnel created for the second half of the year. As we mentioned, there is a near-term headwind specifically for the second quarter.
Nadav, you want to take the second one?
Sure. Hey, Adam, thanks for the question. Look, I would say a couple of things. Number one, you know, it's my job to continue and optimize and see that I have, that we have the right leaders in the right place. I think that one change that we're doing, which is, I think a differentiation, is beyond just the structural changes that, Roei, you spoke about. We're also investing more in marketing. We're doubling down on the channels. To your question about the personality changes that we're conducting, we do wanna bring strong leaders that come from the security business with the right experience, right? In our last earnings call, we announced Rachel Roberts, who's taking as President of Americas.
We and she has experience, you know, vast experience in the cybersecurity market. Tom Malone joined us and is leading globals. Adam Ely comes from the industry and is going to lead the AI Security. The idea is to bring seasoned leaders that know this business and then put, like, reorg the go-to-market organization so these two things work together. The third thing is, which we've been speaking about, is the multi-pillar approach that we're coming with. All in all, I'm very bullish about where that is going to take us. You know, I do acknowledge that in the first quarter, this has created a disruption, but I think it sets us up for success as we go forward.
You'll see, you know, more people joining us at different levels from different companies, as, you know, we are, you know, just getting the right people, the right data, the right processes to create this sustainable growth. You know, we have the vision, we have the mission. I really believe that we have a meaningful headwinds with the products that we have. We're bullish about where that's gonna take us.
All right. Next up is Shaul Eyal, followed by Shrenik Kothari.
Thank you. Good afternoon, guys. Nadav or Roei, maybe sticking with the product revenue question. As you guys know, Check Point as well as its competitors, you guys are selling a number of appliance families, low, mid, high-tier markets. Is there a specific market tier in which you're seeing increased pressure, or the current softness is pretty much across all market tiers?
It's across. I would say mainly around the large. Again, mainly as a result of the disruption in the go-to-market because there were many changes to assignment of enterprise and large enterprise that are mainly consuming the large boxes. I would say that's. Again, we see it across the board, but more on the large one.
I will say this, Shaul. I'm trying to put together the trends that are coming. I know that this is sort of, zooming out a little bit, right. When you think about the priorities of large security organizations, in the, in today and in the next couple of years, which I think are going to be chaotic. If you believe that this democratization, industrialization of the attackers and the changes that agentification is doing in everyone's networks is real, I think that our firewalls are actually very well-positioned for this future. If nothing else, because of the ability to prevent every known CVE and deploy it through our IPS in hours, not days or weeks, this is becoming more and more critical.
I know that we've been preaching this for a long time, but I think this is now going to become more important. I think gives us an advantage not only with the growing with the customers that we have, but going after new logos, which is actually a part of the change that we've made in the go-to-market organization. Now, as Roei said, getting new logos in CTEM is much faster than getting new logos in firewall, I think we have the, we have what it takes, and we have done the, we've done the adjustments. We put the right people in the right places. We'll continue to do it.
It's never good enough. I think it actually gives us a headwind, not only in the emerging categories, but also in the core, in the firewall, which is alive and kicking. Forget Check Point for a second. I think when you look at where the world is going right now, network security is becoming so much more important. It's one of the only places where you can really prepare an organization for the AI adoption. Doesn't happen overnight. I truly believe this is a tailwind for Check Point.
Tailwind it is, yeah. Not a headwind. Yeah.
All right. [crosstalk]
Thank you.
Next up is Shrenik Kothari followed by Keith Bachman from BMO.
Yeah. Thanks a lot. Just maybe to switch gears from appliances, Nadav, you mentioned about the data center, AI Factory Blueprint, and between that and the new AI Defense Plane, the Gemini Agent integration, the secure AI, it feels like you are trying to go after multiple layers of the enterprise AI security stack. Strategically very compelling and you talked about the opportunity. Just how should we think about monetization of this opportunity from here? Where do you see the near-term opportunity this year and in the next 12 months?
Yeah. I'll say this, it is a process that we're making a very substantial investments, right? I think six months ago, we told you about the acquisition of Lakera AI as an example. This is where we're building a truly foundational model. We believe that where if you look at the security for AI, you won't be able to use, you know, existing large language models that can, you know, do everything known to humanity, write poems and protect. Rather, if you want the latency, the accuracy, and the cost, we are going to have to train our own models. That's a huge investment. We're investing in the researchers. We're investing in the GPUs.
We're investing, you know, even thinking out of the box, we created a game called Gandalf, where we have over 1 million worldwide users that thousands of them attack us every day so that we can put that into our small language model to continuously breed it so it can get better and better. That's a big investment. On top of that, we're building security for AI as a platform. For users, for employees, for applications, whether they're looking inside or to customers. Both of these, both people and applications using agents. We're doing the security to the people. We're securing runtime. We're doing it, as I said, with Gemini. We're also doing it with Copilot from Microsoft. All this is heavy investment.
Adam is coming in to lead also the commercial side of this. We're hiring the first salespeople to drive this. We think that it's going to be, you know, still a small part of 2026, but huge potential for the future. That's one thing. Beyond that, it's also gonna feed into our other pillars, because by having those foundational models, we also have people that are simulating, sort of in what we call the future labs, what these attacks of the future are gonna look like. It's not just the AI pillar, it also feeds into our intelligence, it feeds into our email security, it feeds into our endpoint security. I think over time, the value of real security, real proactive security, is going to become more and more important.
At the end of the day, it's a big investment, but I think it's essential, and I think it positions us well for what's coming.
All right. Thank you, Shrenik. Next up in place of Keith Bachman is going to be Todd Weller. Todd. That'll be followed by Tal Liani of BofA.
Thanks, thanks for the question. Just a question on memory pricing. What are you seeing in terms of impacts? More importantly, how are you thinking about it kind of going forward over the remainder of this year? Any kind of additional pricing actions being contemplated.
Memory pricing continue to inflate, to increase. I mean, we see this trend continues. As for, I mean, as for what we are looking out gonna affect our revenue, our product revenues, I talked about it already when we gave the full year guidance. We took into account some disruption from the memory cost also on the firewall business. Right now, I think tough to say if it's, if there is anything related to that. I mean, we are looking on the final for the second half of the year. We see good finance for firewall. I mean, tough to say how it will impact right now.
I don't know to tell you if it impacted the behavior of our customers in terms of buying firewalls, buying appliances. Definitely I can tell you that the memory costs are continue to surge and I don't see it stops, I mean, in the near term.
All right. Thank you, Todd. Up next is Tal Liani with BofA.
Hey, guys. Can you hear me? Yes.
Yes.
Nadav, I keep asking you the same question. I'm gonna come back to the same question. You joined the company a few years ago with hope that growth is gonna accelerate. You've done many things on sales, on products, growth has decelerated instead of accelerating, in the sense that we are now at 5% environment. It's just not big enough for such a great space. There could not be a better space for you to grow and accelerate revenues, revenue growth. The question is, what is not working with the strategy? What is not working? How can you change the growth trajectory to the point that we see double digits, sustainable double digit growth? Really to synthesize the question, the issue is what is the problem? Meaning, is it about sales execution? Is it about portfolio?
Is it about the employee composition and the fact that maybe culture needs to change? I'm trying to understand what can you do in order to change the growth trajectory?
First, Tal Liani, I totally agree that we couldn't be in a better industry right now. You know, I think that like you said, that's why I'm here, and that's what I'm here to do. Look, as we said before, yes, some of it is execution, and that's why we're making these changes that we just spoke about, which are meaningful. You know, hundreds of people getting new accounts, moving seats, putting new leaders. I think it's essential, you know, giving us a short-term headwind, but I think will drive that sustainable growth that you're looking for.
At the same time, I do wanna say that, when you look at the total product portfolio that we have, although it's still not the biggest part of what we do, if you look at the emerging technologies that we have, right? Email, CTEM, SASE, and hopefully and now joining with security for AI, that's, that, as Roy showed, as we spoke about before, is growing really, really fast and becoming a bigger piece of what we're doing. You know, all in all, I think that the vision and the strategy are there. We're making the changes that we need to do. It does take time and, you know, we need to continue course and have the patience to get there.
'Cause, you know, we need to do it with discipline and that's what we're doing, and it's gonna take time but believe that we're in the right business with the right products. In every one of the pillars that I spoke about, we're also looking at acquisitions. I believe that when you bake all that together with the leadership that we're putting in place, we'll be in a good place in the future.
Yeah. Thank you.
Thanks, Tal. Up next is Joshua Tilton from Wolfe, followed by Jonathan Ho of William Blair.
Thank you, guys. I love getting no warning. With that in mind, I'll keep it to one.
Apology.
It's okay. You caught me off guard a little bit. Maybe one for Roei. Can you just reiterate exactly what you expect in the second half for Appliance? I wasn't sure if you said stabilize or recover. Maybe just talk to kind of the visibility you have or maybe the confidence you have around that view.
For the second half of the year, you do expect to see improvement. Right now for the second quarter, we do expect to see a decline, a sharper decline in the product revenues. For the third quarter and the fourth quarter, things gonna be gradually. We see a much better funnel also for the Appliances, and we do expect to see improvement there. It doesn't mean that we're gonna grow in Q3 and Q4 product revenues, definitely, we're gonna show better performance compared to what we had in Q1 and what's expected for the second quarter. What we had in Q1 and what's expected for the second quarter. I'm hearing myself.
Maybe just, you know, can you just talk to the confidence level around that, like just you're seeing in the funnel?
Someone, I'm hearing can you hear it also? There is an echo. I'm hearing Can you hear it also? [crosstalk] Josh, one moment.
Can you just talk to, like, what's driving the confidence in that view? Is it just what you see in the funnel? Like, any incremental color would be helpful.
We see improvement in the funnel. If we're looking, well, we are checking all the time, I mean, these metrics on a weekly basis. We see improvement in the funnel for the second half of the year. We see very nice deals, large deals in the funnel that are progressing. Again, we are doing these checks, we are doing the discussion with the go-to-market leaderships across the world. We feel more confident about the second half of the year. We do see even already some nice deals that we already won over the competition, over our competitors, win backs of large enterprises.
Of course, we're not going to see it as revenues in the second half of the year. We see these kind of deals being closed and will affect our revenues in the second half of the year. All of that together put us in much better, I mean, much better view for the second half.
Helpful. Thank you.
All right. Next up is Jonathan Ho, followed by Peter Levine.
Hi, good morning. Thanks for taking the question. You referenced some strong growth in your security for AI solutions, but they're still relatively small contributors, but with that strong pipeline build, particularly in the last couple of weeks. When do you expect AI security to be more of a material contributor? Will this be more sort of standalone products, or can there be maybe a stronger tip-of-the-spear-type solution where you can land some new customers, so cross-sell within your base versus landing new customers?
Yeah, thanks for the question. Look, early innings, right? I think to become a substantial part of our revenue, that will only happen. As a standalone, that will only happen in 2027. It's a big investment. Organizations are going to inevitably, even those that are trying to sort of, you know, slow down the adoption, inevitably need to adopt new AI for their employees, for their applications, etc. We're all seeing it in our own personal lives. We're seeing it in our businesses, etc. It's a process. As a standalone business, I think to be substantial to Check Point, 2027. Beyond that, you're right. It's not just a standalone.
For example, it's part of our workspace pillar, where, you know, workspace employee usage is sold as a bundle through our workspace. You know, when you look at the infrastructure level where we spoke about the firewall business being able to double down on the infrastructure and embed AI in the NVIDIA GPUs, again, as Roei said, we're only seeing the first glimpse of these projects happening. As they happen, I think we're gaining advantages. To answer your question, I think it's both as a standalone and as a contributor to our other pillars. You know, even to our not just to our product is.
One of the fastest growing things in security for AI is AI red teaming as an example, which is a part of our services business. It does have an impact on each one of those, and as a standalone. To be a real impact on our revenue, and, you know, become a significant part, 2027.
All right. Thank you, Jonathan. Next up is Peter Levine, followed by Saket Kalia.
Great. Thanks, Kip. maybe just to double down. You know, when you last reported mid-February, maybe just help us, when did you really see the material impact to the go-to-market strategy? Then maybe help us understand, you know, the deals that were impacted. Are these upsells, renewals or, like, net new deals? Meaning, like, what's the level of confidence that if it was net new deals, these are still in the pipeline. Obviously, you talked about stabilization in the second half, just help us understand, like, the impact and, like, where those deals fell.
I think when we reported back then in February, we were in the middle of the process. I mean, we are middle. We started it sometime in January, but we're in the middle of the process. We did expect some kind of disruption back then. When we looked and after when, I mean, when we look, we're looking at February or March, we did see this disruption affecting our funnel, affecting our funnel creation, mainly for the second quarter and some for the third quarter. We did see some delays of funnel creation. We see that coming. We did see these delays affecting it and we see in the last few weeks the impact.
We see that in the last few weeks we do see a significant change in the funnel creation. These delays mainly impact the second half, the first half of the year. Again, there were, of course, there are several deals that have been pushed from first half to the second half. It's important to say that renewal business looks stable. We don't see any. It's mainly affected new businesses and in firewall. That's the main change. I mean, when we talk back, I mean, we have been in the middle of the process. As Nadav said today, I think we are in the last inning. We're almost done with these changes, and we are now more confident with what we see for the second half of the year.
Thank you.
All right, up next is Saket Kalia, followed by Eric Heath.
Okay, great. Hey guys, thanks for taking my question here. I wanna shift gears a little bit, and Roei, maybe the question is for you. You know, the growth in emerging ARR and billings was great to see, 40%, 45%, I think those numbers were. Can you just remind us how big those businesses are in aggregate, as a percent of subscription revenue? Then I wanna connect that back to some of the go-to-market changes. How can some of the go-to-market changes maybe support growth in those emerging products going forward?
We don't, we're not disclosing it, but these specific three product are slightly below, I would say slightly below 30% of our ARR for subscription. Think about that area, these specific three products. Nadav, you want to talk about the go-to-market?
Yeah, look, when you look at the go-to-market adjustments we've made, it does support exactly what you said, right. We're doubling down investment on these pillars, but also integrating our work, our sales force together with them. That is, when we want to become a multi-pillar organization, we want our account managers to be able not just to do firewall, but also the emerging business. That's part of the change that we're doing. Beyond that, we need to go to our channels and introduce them to these new products which some of them are novel to them. You're right. On the one hand, we need to push these emerging technologies and capabilities faster, and we're doing that.
At the same time, we are going to go after new logos, win backs, etc, with what I believe is a tailwind of what's happening from the attacker's perspective and our capabilities. At the end of the day, it's obviously the, you know, the change itself is disruptive. Now I think we're at the tail end of the disruption. As Roei said, we're starting to see the upside, but it's never ending. We gotta get the right people, we gotta get the right data, we gotta get the right processes. Ultimately, it's putting a really big focus on our go-to-market all the way from funnel creation, demand creation, channels, the people, the processes, et cetera. That's what we're doing. I think it positions us for the future.
Very helpful. Thanks.
All right. Next up is Eric Heath , followed by Roger Boyd. Eric, unmute. There you go.
There you go. A little slow on the trigger. Thanks, Kip. Thanks for taking the question. Nadav, I wanted to come back, I mean, to your comment about M&A. It's been part of the strategy with tuck-ins, and you have the balance sheet strength, which is a strong suit for yourself, and relatively muted valuations out there, broadly speaking. Just anything you can share about more transformational M&A as part of the strategy going forward. Thanks.
Yeah. Thanks, Eric. We're looking at this based on our pillar approach, right? Which at least in my mind is very, very clear. What do we want to achieve in the hybrid mesh? What do we want to achieve in CTEM? What do we want to achieve in Workspace? In each one of them, our M&A teams are constantly hunting for, you know, early stage startups with foundational technologies that we can take advantage of, but also larger opportunities. I do think that one, our balance sheet, second, our discipline, and third, the volatility in the market is going to create opportunities for us. We are gonna make those moves when, you know, when it's strategically within what we wanna do in the pillar.
We believe that from an execution culture, you know, we have the ability to do it. When all these ducks are lined up, that's when we're gonna make those biggest, those bigger moves.
Thank you.
All right, next up is Roger Boyd, followed by Matthew Hedberg.
Awesome. Thanks, Kip. Nadav, I wanted to come back to emerging products. I think you mentioned 90% growth in CTEM, 40% growth in email. Just any sense on where you are in terms of SASE growth, and to what extent is that business impacted or not impacted by some of the dynamics you're seeing across product and firewall right now? Thanks.
Thank you. Look, SASE has become a fundamental part of the hybrid mesh network security. We're making really big investments there. We have, you know, our R&D part is rushing to complete our feature list. We're now able to go upstream to the larger enterprises, creating some differentiated, unique capabilities. In terms of the impact, no, I don't think it was impacted by the go-to-market change. I think the go-to-market change primarily affected our core, our firewall, with people moving around. In fact, we're doubling down on our SASE, you know, sales capabilities.
We joined forces with our CGNS, our cloud network security sales force with SASE, so in effect that we now have a bigger team and more salespeople that can do both. As this matures, the most important thing for us is to make sure that our general account managers can also be selling SASE. That's sort of the trajectory we're going into. It is becoming more and more important around our hybrid mesh network security as organizations are, you know, moving. In fact, I think adoption of AI is actually going to make this even more critical.
Very helpful. Thank you.
All right. Our last questioner today is going to be Matthew Hedberg.
Hey, thanks, Kip. Hey, Nadav. You know, I think.
Nadav again. It's been clean today.
With all the advancements from some of the AI models, and with Mythos, you know, I mean, it's got to represent an incredible challenge for not only customers, but even for some of your engineers. Like how, what is the focus internally with keeping up with this rapid change from these frontier models and like, you know, how do we as a cyber community, you know, adapt to this?
Yeah. Look, I think that's sort of the biggest question that we're all looking at, right? When you think about it, we're witnessing democratization and industrialization from the attacker side. That's a huge shift. Our networks, as they become agentified, they really change the nature of the networks. Because if you really want to harness agents, you gotta give them the ability to get into different data sets. That create different pathways that we haven't seen before. This is not a new shift, but it's accelerating dramatically. Look, we're preparing for this era for a long time. It's not just about a single model announcement like Mythos. I think we're executing intensively over the past year. I'll give you one example of what sets us apart.
You know, we have the depth of the research. We have folks in Tel Aviv, in Zurich, in San Francisco, that are building this foundational model that we're constantly feeding, in order to anticipate that future. Again, like I said before, this allows us not just for the latency and accuracy, but also the cost structure. We've started working in different verticals like banking, health, energy with large design partners, so that not only we try to anticipate what the attackers are doing, but they also tell us what they're doing in order to optimize their own organizations, you know, irrelevant, not because of cyber, but because how they want to harness these models, and together we're trying to understand how to securely adopt them.
You know, one of the things that I'm very, you know, glad to see is that someone like Adam Ely is joining us. We're seeing, like, you know, we're securing Microsoft Copilot, we're securing Gemini at Google. You're right, this is a fundamental change. I think at the end of the day, it, on the one hand, we wanna move really fast with AI adoption. On the other hand, we need to use our decades of hardening our environments, so that we can get ahead of the curve before exploits go public. In this case, I think that our IPS signature and WAF rules is, you know, best in the industry right now. I think it positions us well.
I think there are gonna be many more models. I think a lot of them are going to become publicly available. We're really just seeing the beginning of this. zero days become one days. The time to patch is going to need to accelerate dramatically. This is where we're bringing our CTEM capability. Again, when you put these things together, I really think that we have a proposition to customers that not just gonna keep them more safe, but also allow them to do this AI adoption. Having said all that, look, there's a lot of unknown. I wanna be very clear about that. Some of the things that we're seeing with these new models is truly a game changer.
What we're doing in order to try to stay ahead of it is not just to try to see what's happening in the wild, but also to get to try to simulate how the attackers are going to take advantage of these tools, 'cause there's a, the whole attack, you know, a process. Everybody's talking about vulnerabilities, but there's so many other things that we need to be aware of in order to stay ahead of this. You know, in that sense, these are really exhilarating time. I think, like was said before, this is a good time to be in this industry from a business perspective, but it's also one of the most important times to be in this industry, so that we can keep this digital world running.
All right, guys. Thank you very much for attending. I'm sure we'll see you guys throughout the quarter and we'll be speaking to quite a few of you over the next few days. Have a great day. We'll see you guys soon. Bye-bye now.
Bye. Thank you.